2026 Blueberry Pediatrics (SparkMD) — Metabase vulnerability; children’s protected health information stolen
Data compromised
For children and their guardians: name, health plan name and policy number, date of birth, health care information such as medical records, dates of service, medical codes and charges. A subset included name, address, phone number, email or member ID, and medication information. Photos and videos were stored separately and not compromised. No Social Security or payment card numbers.
Technical writeup
Two company notification letters from SparkMD Inc. on behalf of Blueberry Medical, filed with the California Attorney General on Oct 10, 2026. Discovery Aug 22, 2026; the attacker stole a copy of some patient data through the Metabase vulnerability. The notices describe the data as protected health information about children. recordsAffected 0 (count not listed).
Root cause
Criminal exploitation of a vulnerability at Metabase, a technology provider to Blueberry Medical. Blueberry Medical discovered evidence on Aug 22, 2026.