---
title: "Dorsata Metabase patient-data incident"
description: "Dorsata reported unauthorized patient-database access through a Metabase vulnerability during August 10–12, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-23"
canonical_url: "https://www.ally.security/incidents/dorsata-metabase-patient-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/dorsata-metabase-patient-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/dorsata-metabase-patient-data-incident-2026/stix.json"
---

# Dorsata Metabase patient-data incident

A business-intelligence software flaw exposed Dorsata’s patient database to unauthorized access.

Last modified Oct 23, 2026 · 2 sources

## Summary

- **Environment:** Metabase software connected to Dorsata’s patient database
- **Operational impact:** No service-outage duration established
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Dorsata](https://dorsata.com/) said a [Metabase](https://www.metabase.com/) vulnerability allowed unauthorized access to its patient database between August 10 and 12, 2026. [2](#source-2)

## Impact

Potentially involved information included names, addresses, patient IDs, birth dates, vital signs, treatment details and locations, provider names, vaccines, medications, insurance details and medical histories. Dorsata excluded Social Security numbers, driver’s-license numbers and financial information. No affected-person total was disclosed. [2](#source-2)

## Timeline

### August 12, 2026 — Vulnerability notice prompted response

Dorsata patched the software and began investigating. [1](#source-1)

### October 14, 2026 — Public patient notice

The [disclosure](https://dorsata.com/2026-metabase-security-incident/) described patient-data risks. [2](#source-2)

### October 23, 2026 — Briefing updated

This briefing was last reviewed and updated on October 23, 2026.

## Threat Group & Attack Vector

The notice identifies vulnerability exploitation in Metabase, without a CVE or detailed intrusion sequence. [2](#source-2)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Dorsata investigated with cybersecurity specialists, applied patches and notified patients for healthcare-provider partners. [1](#source-1) It reported no evidence of misuse or attempted misuse. [2](#source-2)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/dorsata-metabase-patient-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Dorsata Metabase consumer notification template

official · Dorsata

<https://oag.ca.gov/system/files/Regulatory%20Notice%20Letter_Dorsata_CA_0.pdf>

<a id="source-2"></a>

### 2026 Metabase Security Incident

official · Dorsata · Oct 14, 2026

<https://dorsata.com/2026-metabase-security-incident/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Vulnerability notice prompted patching and investigation
2. **Occurred At · 100% confidence · current**  
   Public patient notice published: 2026-10-14
3. **Resulted In · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Dorsata patched the software immediately after receiving a vulnerability notice on or about August 12, investigated with independent experts and sent notices on behalf of healthcare-provider partners.
4. **Affected Organization · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Dorsata, Inc.
5. **Occurred At · 100% confidence · current**  
   Vulnerability notice prompted patching and investigation: 2026-08-12
6. **Used Product · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Metabase
7. **Disclosed At · 100% confidence · current**  
   Dorsata Metabase patient-data incident: 2026-10-14
8. **Resulted In · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Dorsata said a Metabase vulnerability allowed unauthorized access to its patient database from August 10 through August 12, 2026.
9. **Resulted In · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Public patient notice published
10. **Resulted In · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Potentially involved data included names, addresses, patient IDs, dates of birth, vital signs, treatment information and location, provider names, vaccines, medications, insurance details and medical histories.
11. **Resulted In · 100% confidence · current**  
   Dorsata Metabase patient-data incident: Dorsata said Social Security numbers, driver’s-license numbers and financial information were not involved; it had no evidence of misuse or attempted misuse.
12. **Began At · 100% confidence · current**  
   Dorsata Metabase patient-data incident: 2026-08-10
13. **Ended At · 100% confidence · current**  
   Dorsata Metabase patient-data incident: 2026-08-12

</details>