---
title: "Blueberry Pediatrics Metabase data incident"
description: "Blueberry reported patient-data theft through a Metabase vulnerability discovered in August 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-13"
canonical_url: "https://www.ally.security/incidents/blueberry-pediatrics-metabase-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/blueberry-pediatrics-metabase-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/blueberry-pediatrics-metabase-data-incident-2026/stix.json"
---

# Blueberry Pediatrics Metabase data incident

Blueberry discovered that a vulnerability in its reporting environment had enabled theft of patient data.

Last modified Oct 13, 2026 · 1 source

## Summary

- **Environment:** Metabase reporting and data-analysis environment
- **Operational impact:** No service-outage duration established
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Blueberry](https://blueberrypediatrics.com/) discovered patient-data theft on August 22, 2026. Its [consumer notice](https://oag.ca.gov/system/files/Blueberry%20Template%20Consumer%20Notices.pdf) attributes the intrusion to exploitation of its Metabase environment. [1](#source-1)

## Impact

Potentially involved information included names, health-plan and policy details, birth dates, medical records, service dates, codes and charges. Blueberry said Social Security numbers, payment information and separately stored clinical images and videos were excluded. The notice gives no affected-person count. [1](#source-1)

## Timeline

### August 22, 2026 — Intrusion discovered

Blueberry identified the compromise and blocked unauthorized access within hours. [1](#source-1)

### October 13, 2026 — Briefing updated

This briefing was last reviewed and updated on October 13, 2026.

## Threat Group & Attack Vector

The notice identifies a vulnerability in [Metabase](https://www.metabase.com/), but gives no CVE identifier or detailed intrusion sequence. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Blueberry patched the software, changed passwords and security protocols, contacted law enforcement and engaged forensic specialists. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/blueberry-pediatrics-metabase-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Blueberry consumer notice — Metabase incident

official · Blueberry Pediatrics

<https://oag.ca.gov/system/files/Blueberry%20Template%20Consumer%20Notices.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Blueberry discovers intrusion: Blueberry identified exploitation and blocked the unauthorized party within hours.
2. **Discovered At · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: 2026-08-22
3. **Resulted In · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Blueberry reported that an unauthorized party exploited a vulnerability in its Metabase instance and stole a copy of patient data.
4. **Resulted In · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Blueberry said separately stored patient photos and medically necessary videos were not compromised and Social Security numbers and payment information were not involved.
5. **Affected Organization · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Blueberry Pediatrics
6. **Used Product · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Metabase
7. **Resulted In · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Blueberry discovers intrusion
8. **Resulted In · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Blueberry patched the vulnerability, changed system passwords and protocols, notified law enforcement and retained external forensic specialists.
9. **Resulted In · 100% confidence · current**  
   Blueberry Pediatrics Metabase data breach: Potentially involved fields included names, health-plan and policy information, dates of birth, medical records, service dates, service codes and charges.
10. **Occurred At · 100% confidence · current**  
   Blueberry discovers intrusion: 2026-08-22

</details>