Vendor Incident Affects 341,000 Blueberry Pediatrics Patients
Blueberry Pediatrics, a telemedicine service provider that offers subscribers access to board-certified pediatricians, has been affected by a data security incident involving a third-party tool called Metabase. The incident resulted in the theft of the sensitive data of 340,915 individuals.
Metabase, a business intelligence and data visualization platform used by more than 100,000 organizations, was found to contain a critical vulnerability. On August 22, 2026, Blueberry Pediatrics learned that the vulnerability had been exploited by a hacker who obtained a copy of patient data. Metabase was also used by Photon, a prescription service provider used by Blueberry Pediatrics, that exposed a subset of the same information. On August 24, 2026, Photon advised Blueberry Pediatrics that the vulnerability had also been exploited by a different threat actor, who also obtained a copy of patient data.
Blueberry Pediatrics has analyzed the impacted data and determined that the stolen data included patient information such as names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and charges for services. Individuals impacted by the incident at Photon had their names, addresses, phone numbers, email addresses, member IDs, and/or medication information compromised. Blueberry Pediatrics has confirmed that photos and videos provided by patients were stored separately and were not compromised in the incident, and financial information and Social Security numbers were not involved.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Blueberry Pediatrics said immediate action was taken when it was notified about the vulnerability by Metabase and applied the patch to fix the vulnerability within hours; however, a threat actor already had access to its data. The access was immediately blocked, and after patching, passwords and security protocols were changed. Additional steps have been taken to harden security, including strengthening authentication controls, increasing the frequency of security reviews, and implementing an additional monitoring and escalation process for critical vendor vulnerabilities.
Because the same data was exposed in multiple incidents, some of the affected individuals are likely to receive more than one breach notice. The data breach is not currently shown on the HHS Office for Civil Rights breach portal; however, the Oregon Attorney General was informed that 340,915 individuals were affected. The Texas Attorney General received two breach reports, one involving the information of 60,581 state residents and the other affecting 7,249 state residents.
