Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patients - The HIPAA Journal
A Virginia healthcare technology company has disclosed a data breach affecting 58,249 individuals, which was caused by the exploitation of a zero-day vulnerability in its Metabase software.
Dorsata, an Arlington-based healthcare technology company, has notified the HHS Office for Civil Rights about a breach involving the protected health information of 58,249 people.
The incident was caused by the exploitation of a previously unknown vulnerability, or zero-day, in the Metabase business intelligence software the company uses.
The vulnerability was patched on or around August 12, 2026, and cybersecurity experts were engaged to investigate its prior use.
The investigation confirmed that between August 10, 2026, and August 12, 2026, an unauthorized third party exploited the vulnerability and gained access to a database platform.
The exposed data included names, addresses, patient IDs, dates of birth, vitals data, treatment information, locations, provider names, vaccination details, medications, insurance information, and medical histories.
Dorsata has found no evidence to suggest that the information has been misused.
The group behind the initial exploitation has not been established, but the Dire Wolf group appears to have exploited the vulnerability in at least two subsequent attacks, according to VenariX.
Separate Incidents in Florida and Michigan
In a separate incident, Bay Area Psychological Consultants in Niceville, Florida, has started notifying 5,679 patients that their data was exposed.
The breach was caused by a network disruption at its technology service provider, CareCloud, which experienced unauthorized access to one of its AWS environments between March 10 and March 16, 2026.
The unauthorized access was terminated on March 16, and no further activity has been detected.
The exposed files contained names, email addresses, dates of birth, medical record numbers, Social Security numbers, treatment locations, appointment information, and provider information.
The clinic has advised all affected individuals to remain vigilant against identity theft and fraud.
Lansing Urgent Care in Michigan has also disclosed a cybersecurity incident that was first identified on September 11, 2026.
The clinic’s website notice states that certain data was accessed and exposed by an unauthorized third party, and the attack appears to be a ransomware incident.
Related
