Incident BriefingsBlueberry Pediatrics Metabase data incident

Blueberry Pediatrics Metabase data incident

Blueberry discovered that a vulnerability in its reporting environment had enabled theft of patient data.

Last modified

Summary

  • Environment: Metabase reporting and data-analysis environment
  • Operational impact: No service-outage duration established
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 13, 2026; updated as evidence emerges.

What happened

Blueberry discovered patient-data theft on August 22, 2026. Its consumer notice attributes the intrusion to exploitation of its Metabase environment. [1]

Impact

Potentially involved information included names, health-plan and policy details, birth dates, medical records, service dates, codes and charges. Blueberry said Social Security numbers, payment information and separately stored clinical images and videos were excluded. The notice gives no affected-person count. [1]

Timeline

  1. Intrusion discovered

    Blueberry identified the compromise and blocked unauthorized access within hours.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on October 13, 2026.

Threat Group & Attack Vector

The notice identifies a vulnerability in Metabase, but gives no CVE identifier or detailed intrusion sequence. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Blueberry patched the software, changed passwords and security protocols, contacted law enforcement and engaged forensic specialists. [1]