Incident BriefingsDorsata Metabase patient-data incident

Dorsata Metabase patient-data incident

A business-intelligence software flaw exposed Dorsata’s patient database to unauthorized access.

Last modified

Summary

  • Environment: Metabase software connected to Dorsata’s patient database
  • Operational impact: No service-outage duration established
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 23, 2026; updated as evidence emerges.

What happened

Dorsata said a Metabase vulnerability allowed unauthorized access to its patient database between August 10 and 12, 2026. [2]

Impact

Potentially involved information included names, addresses, patient IDs, birth dates, vital signs, treatment details and locations, provider names, vaccines, medications, insurance details and medical histories. Dorsata excluded Social Security numbers, driver’s-license numbers and financial information. No affected-person total was disclosed. [2]

Timeline

  1. Vulnerability notice prompted response

    Dorsata patched the software and began investigating.

    [1]

  2. Public patient notice

    The disclosure described patient-data risks.

    [2]

  3. Briefing updated

    This briefing was last reviewed and updated on October 23, 2026.

Threat Group & Attack Vector

The notice identifies vulnerability exploitation in Metabase, without a CVE or detailed intrusion sequence. [2]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Dorsata investigated with cybersecurity specialists, applied patches and notified patients for healthcare-provider partners. [1] It reported no evidence of misuse or attempted misuse. [2]