A hospital scheduling suite’s backend gave up 58,000 women’s health records through a widely deployed analytics tool that had a flaw nobody had disclosed yet. Dorsata, an Arlington, Virginia vendor whose software runs medical records for fertility and OB-GYN practices, told the HHS Office for Civil Rights that 58,249 people were affected. The intruders were inside its database platform for two days, from August 10 to August 12, 2026.
Two days between notice and abuse
Metabase, the open-source business intelligence layer Dorsata used to query clinical data, carried a previously unknown vulnerability. Dorsata says it was alerted around August 12, patched immediately, then hired outside investigators to work out whether anyone had already exploited it. They had. The database held names, addresses, patient IDs, birth dates, vitals, treatment details, prescribing provider names, vaccination records, medications, insurance data and full medical histories for patients of Dorsata’s clinic customers.
Why one flaw reached many clinics
Vendor breaches concentrate risk. One practice management platform sits behind hundreds of small clinics that lack the staff to audit a SQL-backed analytics tool bolted onto their record system. Metabase is popular precisely because it is easy to self-host, which pushes patching onto the customer. Dorsata is the second healthcare exposure through this product covered here in recent weeks. The Dire Wolf group appears to have reused the exploit in at least two later attacks, according to VenariX.
Two more disclosures
Lansing Urgent Care in Michigan confirmed an intrusion first spotted September 11, and Inc Ransom claimed the provider on its leak site. Bay Area Psychological Consultants, a Niceville, Florida clinic, notified 5,679 patients over a March 16 disruption at EHR vendor CareCloud.
Defenders running self-hosted analytics against PHI should inventory every Metabase instance, confirm patch level and review query logs.
