HackingHealthcareHealthcareVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Blueberry Medical

bd_d08c30d20ba682ea · schema v1 · pii pii-v2

Severity

Low

Discovered

Aug 22, 2026

Filed

Oct 10, 2026

To disclose

7 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for Blueberry Medical →2 incidents on file

Blueberry Medical discovered on August 22, 2026, that a previously unknown vulnerability in its third-party technology provider Metabase was exploited, resulting in the theft of patient PHI including names, health plan info, dates of birth, and medical records. SSNs and payment info were not involved. The company contained the incident, patched systems, and engaged forensic investigators.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 49 days

Aug 22, 2026

Discovered

Oct 10, 2026

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Blueberry Medical
norm: blueberry medical
Domain: blueberrypediatrics.com

Name: Blueberry Medical
norm: blueberry medical
Domain: blueberrypediatrics.com
Industry: Healthcarellm

Discovered: Aug 22, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Metabase
Initial access: supply_chain

During the incident: Locked an unauthorized party out of its system
Hardened its system using the patch subsequently distributed by Metabase
Changed the appropriate passwords and security protocols
Reached out to law enforcement
Retained a leading forensic and cyber security response firm
Changes made: Strengthened its authentication
Implemented an additional monitoring and escalation process for its vendors’ critical vulnerabilities
Increased the frequency of security reviews for third-party and self-hosted technology infrastructure, such as Metabase
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-631134
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2026
Raw hash: 4a5b96c11cb1a8a368f7da6c51d71b7de34efec230823d811b2ce7bfdf040f7a

Reporting entityBlueberry Medical

Victim entityBlueberry Medical

Incidentdiscovered Aug 22, 2026

Stated responseLocked an unauthorized party out of its system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov