Dorsata Healthcare Breach: Metabase Zero-Day Exploited, 58,249 Patients Exposed - Homeland411
A zero-day vulnerability in Metabase analytics software led to a breach exposing clinical records of 58,249 patients at Dorsata Healthcare, a Virginia-based women's health software vendor.
Dorsata, Inc., a Charlottesville, Virginia vendor specializing in prenatal and OB-GYN workflow software, confirmed the intrusion in a November 9 PR Newswire notice. The company filed sample breach notices with state regulators, including the California Attorney General's Office. Subsequent reporting by The HIPAA Journal on November 13 revealed the total number of affected patients stands at 58,249.
Unauthorized access to Dorsata's database platform occurred between August 10 and August 12, 2026. The company learned of the Metabase flaw on or about August 12 and applied vendor patches immediately. External cybersecurity specialists were then brought in to determine which database tables were accessed during that 48-hour window.
Metabase Zero-Day Exploited
The breach stems from CVE-2026-72898, a CVSS 10.0 unauthenticated SQL injection flaw in Metabase's password-reset endpoint, POST /api/session/reset_password. This route handles unauthenticated requests by design, meaning remote attackers needed no valid login or session cookie to exploit it. Security advisories show the reset endpoint failed to sanitize user-supplied input before querying the application database.
Crafted SQL payloads sent to /api/session/reset_password allowed attackers to run arbitrary queries against Metabase's internal metadata store, enabling them to seize administrative control of the BI server and pivot into connected clinical databases. With administrative access, intruders could inspect saved SQL questions, read stored connector strings, and run direct queries against linked PostgreSQL or MySQL warehouses.
Because reporting tools pull data from multiple clinics into one analytics layer, a single compromised BI container can expose records across dozens of partner practices.
Patient Data Exposure
Dorsata's platform stores clinical records for partner women's health clinics across multiple states. The exposed data includes full patient names, residential addresses, patient IDs, dates of birth, clinical vitals, treatment details, treatment locations, provider names, vaccination records, medications, health insurance details, and medical history notes.
The company confirmed that Social Security numbers, driver's license numbers, and payment card or banking details were not involved. Dorsata stated its investigation found no evidence of actual or attempted misuse of the exposed records. Affected patients are being directed to dedicated call-center support and credit-monitoring resources.
Response Timeline
After patching the Metabase software around August 12, Dorsata spent approximately two months mapping impacted clinic tables and verifying patient addresses. Written notification letters began going out on October 21, 2026. The company followed up with its November 9 press release and state regulatory filings.
Under the federal HHS HIPAA Breach Notification Rule, covered entities must notify affected individuals and regulators within 60 days of discovering a breach involving 500 or more people. Federal summaries are later published on the HHS OCR Breach Portal. For organizations running self-hosted Metabase instances, applying the patch alone doesn't evict an attacker who already gained admin access.
Related
