Blueberry Pediatrics Data Breach Impacted 340k Individuals

Blueberry Pediatrics, a virtual pediatric care company, disclosed a data breach that affected approximately 340,915 people in the United States, including 7,249 Texas residents.

The breach resulted from a security vulnerability in Metabase, a third-party technology tool used by the company. A separate but related incident also involved Photon, a prescription service provider to Blueberry Pediatrics.

In August 2026, Metabase disclosed that its software contained a vulnerability that could allow an unauthorized actor to gain access to customer instances and data. Criminal actors exploited this flaw to access Blueberry Medical's Metabase environment and steal a copy of certain patient data.

The unauthorized access to Blueberry Medical's systems occurred between Aug. 10, 2026, and Aug. 22, 2026.

Photon experienced its own breach due to the same Metabase vulnerability. A different criminal actor exploited the vulnerability at Photon, resulting in unauthorized access from Aug. 9, 2026, through Aug. 12, 2026.

Photon received a suspicious email on Aug. 19, 2026, identified the vulnerability and patched it on Aug. 21, 2026. Blueberry Medical was notified of the Photon incident on Aug. 24, 2026.

The types of protected health information that may have been exposed in the Blueberry Medical incident included names, health plan names and policy numbers, dates of birth, medical records, dates of service, medical codes and charges for services.

The Photon incident involved a subset of the same information, along with street addresses, phone numbers, email addresses, member IDs and medication information.

The breach did not include Social Security numbers or payment information. Photos and medically necessary videos used by clinicians to help diagnose patients were stored separately and were not compromised.

The breach was disclosed to attorneys general in California and Oregon on Oct. 10, 2026. Blueberry Pediatrics posted a notice about the incident through BusinessWire.

Because Metabase provides services to many companies, the company's notification warned that affected individuals may receive more than one breach notice tied to the same underlying vulnerability.

Blueberry Pediatrics' response to the breach

The company notified affected consumers by mail beginning Oct. 9, 2026. The notification included guidance on how affected individuals can monitor their credit and protect against identity theft.

Affected individuals with questions can call 888-752-8498, Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time, or send an email to help@blueberrypediatrics.com.