Blueberry Pediatrics disclosed that a vulnerability in analytics tool Metabase, exploited against healthcare technology vendor Photon, led to two separate breaches of patient data affecting roughly 341,000 individuals (340,915 notified to the Oregon Attorney General; Texas received two reports covering 60,581 and 7,249 residents). Blueberry's data included names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes and charges; its own patients' contact details, member IDs and medication information were also exposed. Photos and videos from patients were stored separately and not compromised, and no financial data or Social Security numbers were involved. Blueberry applied the Metabase patch within hours, but a threat actor already had access, and Photon advised that a different actor later also obtained a copy of patient data. The incident is not yet listed on the HHS OCR breach portal.

• Source article