Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patients
Data breaches have recently been announced by the Virginia healthcare technology company Dorsata, the Florida mental healthcare provider Bay Area Psychological Consultants, and the Michigan urgent care provider Lansing Urgent Care.
Dorsata, Virginia
Dorsata, Inc., an Arlington, Virginia-based healthcare technology company whose products include electronic medical record software and data solutions tailored for women’s health providers, has recently disclosed a data breach to the HHS’ Office for Civil Rights involving the protected health information of 58,249 individuals.
Like many healthcare organizations, Dorsata uses Metabase business intelligence software. On or around August 12, 2026, Dorsata was informed that Metabase contained a previously unknown (zero-day) vulnerability. A patch was applied to fix the vulnerability, and cybersecurity experts were engaged to investigate whether the vulnerability had been exploited prior to patching.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
The investigation confirmed that between August 10, 2026, and August 12, 2026, an unauthorized third party exploited the vulnerability and gained access to a database platform that contained medical information related to patients of its healthcare provider partners. The data review confirmed that the impacted information included names, addresses, patient IDs, dates of birth, vitals data, treatment information, treatment locations, provider names, vaccination information, medications, health insurance information, and medical histories contained in patient medical records.
While data was exposed, no evidence was found to suggest that any of the information has been misused. The group behind the initial exploitation of the vulnerability has not been established; however, the Dire Wolf group appears to have exploited the vulnerability in at least two subsequent attacks, according to VenariX.
Bay Area Psychological Consultants, Florida
Bay Area Psychological Consultants, a Niceville, Florida-based mental health clinic, has started notifying 5,679 patients that some of their protected health information has been exposed in a recent cybersecurity incident. The incident involved its third-party technology service provider CareCloud. Bay Area Psychological Consultants explained that CareCloud experienced a network disruption on March 16, 2026, that impacted one of CareCloud’s electronic health record environments.
CareCloud’s investigation determined that an unauthorized third party accessed one of its AWS environments between March 10 and March 16, 2026, and claimed to have exfiltrated data. The unauthorized access was terminated on March 16, 2026, and no further unauthorized activity has been detected since. The exposed files were reviewed and found to contain names, email addresses, dates of birth, medical record numbers, Social Security numbers, treatment locations, appointment information, and provider information. Bay Area Psychological Consultants said it is unaware of any misuse of patient data as a result of the incident but has advised all affected individuals to remain vigilant against identity theft, fraud, and other misuses of their personal and protected health information.
Lansing Urgent Care, Michigan
Lansing Urgent Care in Michigan has recently disclosed a cybersecurity incident that was first identified on September 11, 2026. According to its website notice, “certain data was accessed and exposed by an unauthorized third party.” The nature of the attack was not disclosed; however, this appears to have been a ransomware attack.
The INC Ransom ransomware group claimed responsibility and added Lansing Urgent Care to its dark web data leak site. Lansing Urgent Care said the review of the affected data is ongoing; however, the information compromised in the incident likely includes names, addresses, dates of birth, diagnoses, treatment information, prescriptions, and health insurance information. The information involved varies from individual to individual. The affected individuals have been advised to monitor their free credit reports over the next 12 to 24 months. The number of affected individuals has yet to be publicly disclosed.
