Metabase Zero-Day Behind Dorsata Breach of 58,249 Patient Records

A zero-day vulnerability in Metabase business intelligence software gave an unauthorized party access to a database holding the protected health information of 58,249 individuals, according to a disclosure filed by Arlington, Virginia-based healthcare technology company Dorsata, Inc. with the HHS Office for Civil Rights.

Dorsata builds electronic medical record software and data products for women's health providers. Like many healthcare organizations, it runs Metabase, a widely deployed open-source BI tool, as part of its analytics stack.

What happened at Dorsata?

On or around August 12, 2026, Dorsata learned that Metabase contained a previously unknown vulnerability — a zero-day, meaning no patch existed when the flaw was discovered. The company applied a patch and brought in cybersecurity experts to determine whether attackers had already used the hole.

They had. The investigation confirmed that between August 10 and August 12, 2026, an unauthorized third party exploited the vulnerability and reached a database platform containing medical information on patients of Dorsata's healthcare provider partners. That is a two-day window between first exploitation and containment.

The exposed data included:

• Names, addresses, patient IDs and dates of birth
• Vitals data and medical histories
• Treatment information, treatment locations and provider names
• Vaccination information and medications
• Health insurance information

Dorsata found no evidence that any of the information has been misused. The group behind the initial exploitation has not been identified. However, according to threat intelligence from VenariX, the Dire Wolf group appears to have exploited the same Metabase vulnerability in at least two subsequent attacks.

The takeaway: a vulnerability in a common analytics layer, not in the medical records application itself, exposed clinical data for nearly 60,000 people.

How did CareCloud's AWS breach affect a Florida clinic?

Bay Area Psychological Consultants, a mental health clinic based in Niceville, Florida, has begun notifying 5,679 patients that some of their protected health information was exposed in an incident at its third-party technology provider, CareCloud.

CareCloud suffered a network disruption on March 16, 2026, that affected one of its electronic health record environments. The provider's investigation determined that an unauthorized third party accessed one of CareCloud's AWS environments between March 10 and March 16, 2026 — a six-day intrusion window — and claimed to have exfiltrated data. The unauthorized access was terminated on March 16, 2026, and no further unauthorized activity has been detected since.

A review of the exposed files found they contained:

• Names, email addresses and dates of birth
• Medical record numbers and Social Security numbers
• Treatment locations, appointment information and provider information

Bay Area Psychological Consultants said it is unaware of any misuse of patient data but has advised all affected individuals to stay alert for identity theft, fraud and other misuses of their personal and protected health information.

The takeaway: the clinic was breached not through its own systems but through a vendor's cloud environment, and Social Security numbers raise the stakes beyond routine health data.

What do we know about the Lansing Urgent Care incident?

Lansing Urgent Care in Michigan disclosed a cybersecurity incident first identified on September 11, 2026. Its website notice states that "certain data was accessed and exposed by an unauthorized third party." The organization did not describe the nature of the attack, but the incident has the characteristics of a ransomware attack.

The INC Ransom ransomware group claimed responsibility and added Lansing Urgent Care to its dark web data leak site — a standard pressure tactic in double-extortion schemes, where stolen data is published if a ransom goes unpaid.

Lansing Urgent Care said its review of the affected data is ongoing. The compromised information likely includes:

• Names, addresses and dates of birth
• Diagnoses and treatment information
• Prescriptions and health insurance information

The data involved varies from person to person. Affected individuals have been advised to monitor their free credit reports over the next 12 to 24 months. The number of affected individuals has not yet been publicly disclosed.

The takeaway: with the attacker identified as INC Ransom and the data review unfinished, the full scope of this incident is still unknown.

What connects the three breaches?

Each incident reached protected health information through a different vector: a zero-day in third-party BI software, an intrusion into a vendor's cloud environment, and apparent ransomware. All three remain under review, and in each case the provider reports no confirmed misuse of data so far.