2026 Dorsata — third-party Metabase vendor incident; protected health information of clinic patients
Data compromised
Name and other fields that vary by client (the notice leaves the list as a template variable). Dorsata says the Social Security number was not involved.
Technical writeup
Company notification letter filed with the California Attorney General (Oct 21, 2026). The AG listing gives breach dates Aug 10 and Aug 12, 2026. Dorsata provides technology used with electronic health records for women’s health clinics and physicians. The notice names Metabase, the analytics vendor, as the third party involved. Related: the Blueberry Pediatrics incident also names Metabase. recordsAffected 0 (count not listed).
Root cause
Third-party software vendor Metabase. The notice says the incident involved a Metabase vulnerability that gave an attacker access to data held in the analytics platform used by Dorsata.