Privacy UnpackedIncident · one vendor, 3 organisations
The Metabase breach
29 September 2026 to 21 October 2026
3 organisations on the tracker had data taken through Metabase. Each one is listed with the words of the source that names Metabase.
Organisations affected through Metabase
-
Poppins Payroll Company
Social Security numbersFinancial account and card detailsDates of birth+1
23.8KTexas residents
An unauthorized third party used a security vulnerability in Metabase, a software vendor used by the Poppins Payroll Company
notice letter -
Blueberry Pediatrics
Health insurance detailsHealth and medical informationDates of birth+2
340.9KOregon residents
a criminal exploitation of a vulnerability at Metabase, one of Blueberry Medical's technology providers, which resulted in the theft of a copy of some Blueberry Medical patient data
notice letter -
Dorsata
Health insurance detailsHealth and medical information
8.9KTexas residents
a recent data security incident involving a third-party software vendor, Metabase
notice letter
Counts are each organisation’s own and can overlap: one person can be a customer of several. An organisation joins this list only when a source names Metabase as the way its data was taken.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.