Blueberry Pediatrics submitted a data breach report involving a vulnerability in the third-party Metabase platform that led to the theft of sensitive data of 340,915 individuals, which includes patient files and personal information compromised through Photon, its prescription service vendor.
Announced on October 28, 2026, the occurrence involved unauthorized access to patient data through Metabase, which is a business intelligence and data visualization program utilized by Blueberry Pediatrics and Photon. Two distinct threat actors exploited the vulnerability and acquired copies of patient information.
Metabase Vulnerability Exposed Patient Information
Blueberry Pediatrics found out on August 22, 2026, that a hacker had taken advantage of a vulnerability in Metabase and acquired a copy of patient records. Photon, a prescription service provider of Blueberry Pediatrics, also used Metabase, exposing a part of the same data.
On August 24, 2026, Photon informed Blueberry Pediatrics that another threat actor exploited the vulnerability and stole another copy of patient information.
Blueberry Pediatrics looked into the affected data and found several types of compromised patient information. The information contained names, birth dates, health plan names, policy numbers, health records, charges for services, dates of service, and medical codes.
The Photon incident impacted additional personal data. Impacted individuals had a few mix of names, addresses, email addresses, telephone numbers, member IDs, and medication data.
The two incidents had overlapping details. Individuals impacted by the two incidents will most likely get a few breach notification.
Patient Information Not Involved in the Incident
Blueberry Pediatrics established that patient-provided pictures and videos were kept separately and were not exposed. The same goes for financial data and Social Security numbers.
The company analyzed the breached data, which included healthcare and insurance-related data, and personal contact details related to people impacted by Photon.
Blueberry Pediatrics Implemented Security Changes
Blueberry Pediatrics took immediate action after Metabase sent notification about the vulnerability. The company implemented a patch to fix the vulnerability within hours. Nonetheless, a threat actor already got access to its data before the vulnerability was resolved.
The company then stopped the unauthorized access and altered passwords and security protocols. It reinforced security measures with better authentication controls, more frequent security checks, and extra monitoring and escalation procedures for critical vendor vulnerabilities. These measures used the company’s identification of unauthorized access concerning its third-party technology vendor and the separate exposure connected with Photon.
State Breach Reports Identify Impacted Persons
The HHS Office for Civil Rights breach portal did not post the HIPAA-covered incident when it was reported. The Oregon Attorney General was advised that 340,915 individuals were impacted. The Texas Attorney General obtained two breach reports concerning different groups of state residents. One report indicated 60,581 affected individuals, whereas the had 7,249. The reported numbers indicate different breach reports sent to the Texas Attorney General.
The incident concerned patient data compromised through both Blueberry Pediatrics and Photon. Separate exploitation incidents, overlapping data exposure, and multiple breach reports increased the chance that impacted individuals received more than one notification.
Image credits: mangoteen 1644579332 Adobestock / logo©BlueberryPediatrics
