Blueberry Pediatrics, a California-based virtual pediatric care company operating as Blueberry Medical, has notified families of a security incident involving children’s protected health information. The incident traces to a vulnerability in the Metabase platform.
Blueberry Pediatrics’s Data Breach Investigation
Blueberry Pediatrics is a telehealth provider that offers families around-the-clock remote pediatric care from its base in Mountain View, California. Like many digital health companies, it relies on outside technology vendors to analyze business data and generate reports. One of those tools, according to the company’s notice, was Metabase, a widely used business intelligence platform that Blueberry Medical, the entity named in its notice letter, ran in its own environment.
According to the notice filed with the California Attorney General, Metabase disclosed in August that its software contained a previously unknown security flaw that could let an unauthorized person reach customer instances and the data stored in them. Blueberry reports that a criminal actor exploited that flaw to gain administrator-level access to its Metabase environment and copy some patient data. The company’s public statement says the exploitation began on August 10, 2026, and that it was part of broader activity targeting the same Metabase weakness across many organizations.
Blueberry says it detected the unauthorized access on August 22, 2026, and started its incident-response process. Per the company, it terminated the unauthorized sessions within roughly an hour of detection, preserved logs and other system evidence, applied the patch Metabase later distributed, changed passwords and related security protocols, contacted law enforcement, and hired a forensic and cybersecurity firm. The company also says it has strengthened authentication, added monitoring and escalation steps for critical vendor vulnerabilities, and increased the frequency of security reviews for third-party and self-hosted technology.
The incident has a second layer. Photon, a prescription service provider that works with Blueberry, experienced its own separate incident through the same Metabase vulnerability, caused by a different criminal actor. Blueberry says Photon told it about that incident on August 24, 2026, and that the Photon incident exposed a subset of the same patient information. Photon reportedly identified the vulnerability and patched it on August 21, 2026, and determined that data was obtained during unauthorized access from August 9, 2026 through August 12, 2026. Because both incidents trace back to the same flaw, the notice warns that a family may receive more than one letter.
The notice letter is addressed to the parent or guardian of the affected children, which tells us the people involved are minors. That matters. A child’s identity can be misused for years before anyone notices, because children rarely have credit reports, and nobody is routinely checking them. Medical and insurance details are also valuable to fraudsters, since they can be used for fraudulent insurance claims, medical identity theft, and convincing phishing messages that reference real treatment details.
Blueberry has not publicly stated how many patients were affected, and the sample letter on file with the California Attorney General does not give a total. The company announced the incident in a public statement on October 9, 2026, and the matter appeared on the California Attorney General’s breach listing on October 12, 2026. The sample letter on file is a template with fill-in fields for names and dates, so the exact mailing date for individual letters is not stated in the filing.
Healthcare organizations are frequent targets of data theft because patient records combine identity details with health and insurance information. When a vendor tool is the point of entry, as is alleged here, the exposure can reach many organizations at once, which is why a single software flaw can lead to several related notices. Under state and federal breach-notification rules, organizations that hold patient information are expected to protect it and to notify people when it is accessed without authorization. Families who received a notice should keep it, since it documents the incident and can matter if they later pursue legal options.
This page will be updated if Blueberry or regulators release more information, including the number of people affected and any services offered to families.
When Did This Breach Occur?
According to Blueberry, an unauthorized actor exploited the Metabase vulnerability on August 10, 2026, and the company detected the unauthorized access on August 22, 2026. Blueberry says it cut off the unauthorized access within about an hour of detection.
Photon, the prescription service provider, reportedly saw unauthorized access from August 9, 2026 through August 12, 2026, patched the flaw on August 21, 2026, and notified Blueberry of its own incident on August 24, 2026. Blueberry publicly announced the incident on October 9, 2026, and it was listed with the California Attorney General on October 12, 2026.
What Information Was Breached?
The notice says the information that may have been exposed includes a child’s name, health plan name and policy number, date of birth, and health care information such as medical records, dates of service, medical codes, and charges for services.
The Photon incident involved a subset of that information: a name, street address, phone number, email address, or member ID, along with medication information. Blueberry states that the incident did not include Social Security numbers or payment information, and that the photos and videos clinicians use for diagnosis are stored separately and were not compromised.
What You Can Do
Even without Social Security numbers, health and insurance details can be misused, so families should stay alert. Consider these steps:
Review explanation-of-benefits statements and insurer messages for services your child did not receive. Report anything unfamiliar to the insurer right away.
Check your child’s credit. Request free credit reports at annualcreditreport.com, and ask the three national credit bureaus about placing a security freeze or fraud alert, both of which are free.
Be careful with calls, texts, and emails that mention your child’s care, prescriptions, or insurance. Contact the company through a number you already trust before sharing anything. Report suspected identity theft to local law enforcement, your state attorney general, and the Federal Trade Commission at ftc.gov/idtheft.
Questions can be directed to Blueberry’s call center listed in the notice letter. Keep your notice letters, because you may receive more than one.
File a Data Breach Lawsuit Against Blueberry Pediatrics
Families whose children’s information was involved in the Blueberry Pediatrics incident may have legal options, including joining a class action over the company’s data security practices and its handling of children’s health information. A lawyer can explain how a claim could work, what deadlines may apply, and what compensation may be available.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
