Blueberry Medical

Blueberry Medical discovered on August 22, 2026, that a previously unknown vulnerability in its third-party technology provider Metabase was exploited by an unauthorized actor. The exploitation resulted in unauthorized access to Blueberry Medical's Metabase environment and the theft of patient data between August 9 and August 12, 2026. Affected data included names, health plan information, dates of birth, and medical records (PHI). Social Security Numbers and payment information were not involved. Blueberry Medical contained the incident, patched systems, changed credentials, and engaged forensic investigators. The incident also affected a separate provider, Photon, via the same vulnerability.

Blueberry Medical discovered on August 22, 2026, that a previously unknown vulnerability in its third-party technology provider Metabase was exploited, resulting in the theft of patient PHI including names, health plan info, dates of birth, and medical records. SSNs and payment info were not involved. The company contained the incident, patched systems, and engaged forensic investigators.