10-12 August 2026: Dorsata says an unauthorised party exploited a then-unknown Metabase vulnerability and reached a database platform holding partner-clinic medical data. HHS: 58,249 people. See the Dorsata breach record.
HIPAA Journal on 13 November is the census source. California AG sample was the first public letter (listed 9 November, breach dates 10 and 12 August). Dorsata makes EHR-adjacent tools for women's health clinics. Dire Wolf later exploited the same class of bug, VenariX said. That later use is not an attribution of this first window.
What happened at Dorsata?
Around 12 August Dorsata was told Metabase had a previously unknown vulnerability. A patch went on. Forensics found exploitation 10-12 August against a database platform with partner-clinic medical information. No misuse found.
This is a vendor path for the clinics that use Dorsata, not a statement that every women's-health practice in the country was copied. Clinics should ask Dorsata whether their tenant was in the 58,249.
What data was exposed?
Names, addresses, patient IDs, dates of birth, vitals, treatment, treatment locations, provider names, vaccination, medications, health insurance and medical histories. The earlier California notice said SSN was not involved. recordsAffected is 58249.
Vitals plus histories plus insurance without SSNs is still PHI. Watch insurer mail. A later letter that adds SSN would change the freeze advice. The current letter says no SSN.
The CareCloud post is a much larger 2026 health-IT vendor file. Keep the two vendors separate.
Who is affected?
Patients of Dorsata healthcare-provider partners whose records sat on the reached database platform, 58,249 people. Someone whose clinic never used Dorsata is outside this row.
More on the vendor is on the Dorsata company page. Bay Area Psychological Consultants is a CareCloud customer notice, not this Metabase event.
What should patients do?
- Ask the clinic, in writing, whether it uses Dorsata and whether your chart was in the 10-12 August window.
- Watch explanation-of-benefits mail.
- The current letter says SSN was not involved. Freeze anyway if a later clinic letter disagrees.
- Treat 'women's health records restore' portals as hostile.
- Dorsata will not collect a CVV through a new domain.
Dire Wolf's later use of a Metabase bug is a separate fact. Do not stamp that brand on this 10-12 August window unless Dorsata or a regulator does.
Why was the count zero before?
The California sample did not publish a nationwide total. HHS 58,249 arrived in the 13 November HIPAA Journal report. Update the census. Keep the no-SSN note from the earlier letter until a filing contradicts it.
Do not invent SSNs because other vendor breaches had them. This letter said they were not involved.
Frequently asked questions
How many people were affected?
58,249, according to the HHS figure reported by HIPAA Journal on 13 November 2026.
What was the path?
A Metabase zero-day exploited 10-12 August 2026, per that report.
Were Social Security numbers involved?
The earlier California notice said SSN was not involved.
Dire Wolf?
Later exploited the same class of vulnerability, VenariX said. Not an attribution of this first window.
Which clinics?
Women's-health provider partners that use Dorsata. Named clinic list unpublished.
Sourcing note: HIPAA Journal 13 November 2026, California AG sample, HHS 58,249.
Do not download alleged Dorsata dumps. This catalog does not link them. A later leak-site post is still an unverified brand until Dorsata names it.
Compare later mail with dorsata.com. Dorsata will not ask for a card CVV or a one-time code through a new website to finish this investigation.
Do not merge this row with the CareCloud AWS EHR incident. They are separate catalog files even when they share a season or a vendor class.
If you did not receive a letter, you may still be in an unpublished state filing. Ask Dorsata in writing whether your identifier sits in the reached file.
US residents can place a free credit freeze at Equifax, Experian and TransUnion. Use the local freeze or watch process named in the notice if you live elsewhere.
Keep the paper letter if one arrives. A later amendment can add fields or a higher census. This catalog will move recordsAffected only when a named official source publishes a new figure. Do not treat a class-action advertisement as a census.
If two organisations share a similar name, read the company page before you enrol in monitoring. Wrong-firm sign-up pages are a common follow-on scam after a widely reported notice.