Blueberry Medical has disclosed a data breach in which an attacker exploited a Metabase vulnerability to steal patient information, including children’s medical records and health insurance details.
The healthcare provider discovered the unauthorized access on August 22, 2026. A separate public statement places the initial intrusion on August 10, when the attacker gained administrator access to Blueberry’s Metabase environment.
According to the notification, Blueberry used the business intelligence platform for reporting and data analysis. The attacker exploited a previously unknown vulnerability to access the environment and copy certain patient data.
Blueberry operates a pediatric telehealth service that gives families round-the-clock access to board-certified pediatricians through its app. Its service combines remote consultations with an at-home medical kit, allowing parents to submit pictures, videos, and measurements to support diagnosis.
Medical and insurance information exposed
The notification includes versions addressed to patients and to parents or guardians of affected children. Information potentially exposed includes:
- Full names
- Dates of birth
- Health plan names and policy numbers
- Medical records
- Dates of service
- Medical codes
- Service charges
Blueberry says Social Security numbers and payment information were not involved. Photos and videos used by clinicians for diagnosis were stored separately and were not compromised.
The disclosed data nevertheless includes sensitive details about patients’ healthcare and insurance coverage. Such information could potentially help criminals make fraudulent messages appear credible, particularly if they impersonate a healthcare provider or insurer.
Neither the attached notification nor Blueberry’s public statement specifies how many patients were affected.
Attack exploited an analytics platform
Metabase’s own investigation traced the broader incident to August 3, when a cloud customer reported an API key created outside normal working hours.
The vendor identified a flaw in its password-reset flow that allowed attackers to inject SQL commands into the application database. In the observed attacks, attackers used this to create an administrator session and an API key that enabled bulk data downloads.
Metabase released patched versions on August 6. It later reported that fewer than 3% of its cloud customers were compromised before patching, and that some users were running publicly accessible, self-hosted installations.
Blueberry says it terminated unauthorized access and associated sessions within about an hour of detection, preserved evidence, and confirmed its Metabase environment was running a non-vulnerable version by then. It also contacted law enforcement and hired a forensic cybersecurity firm.
The company has since strengthened authentication, added monitoring and escalation procedures for critical vendor vulnerabilities, and increased security reviews of third-party and self-hosted infrastructure.
Affected families should review healthcare and insurance statements for unfamiliar services and treat unsolicited requests referencing their medical information cautiously. Verify unexpected communications directly with the provider or insurer using established contact details.
Blueberry also recommends monitoring account statements and credit reports.
Leave a Reply