Blueberry Pediatrics data breach: what to do now

What happened

According to the notice letters filed with the California Attorney General, Blueberry Pediatrics (called Blueberry Medical in the letters) found out on August 22, 2026, that a criminal had exploited a security flaw in Metabase, a business intelligence tool it uses. Metabase disclosed the flaw in August 2026. The attacker stole a copy of some patient data.

The company says it locked out the attacker within hours, applied Metabase's patch, changed passwords and security settings, contacted law enforcement, and hired a forensic firm.

A second letter describes a separate incident at Photon, a prescription service provider Blueberry uses. A different attacker used the same Metabase flaw to access Photon's systems between August 9 and August 12, 2026. Blueberry was told about it on August 24, 2026. Because Metabase is used by many organizations, some families may get more than one notice.

The letters do not say how many people were affected.

What information was exposed

In the Blueberry incident:

• Name
• Date of birth
• Health plan name and policy number
• Health care information, such as medical records, dates of service, medical codes, and charges for services

In the Photon incident:

• Name, street address, phone number, email address, or member ID
• Medication information

The company says Social Security numbers and payment information were not involved, and that photos and medically necessary videos are stored separately and were not affected.

What to do now

1. Read your notice letter closely. It will say whether your child's data was part of the Blueberry incident, the Photon incident, or both.
2. Check the explanation of benefits statements from your health plan. Report any visit, prescription, or service you do not recognize to your plan. Health plan numbers can be used for medical identity theft.
3. Be alert for phishing. Scammers may call, text, or email pretending to be Blueberry, your pharmacy, or your insurer, and they may know your child's name and birth date. Do not share codes, passwords, or payment details. Contact the company using a number you look up yourself.
4. Consider a credit freeze for your child. The notice does not offer credit monitoring, and Social Security numbers were not involved, but freezes are free at Equifax, Experian, and TransUnion and can also be placed for minors.
5. Get your free credit reports at AnnualCreditReport.com and look for accounts you did not open.

Ask Blueberry Pediatrics to delete your data

Every copy of your family's data that a company keeps is one more copy that can be stolen later. Medical records covered by HIPAA generally aren't covered by state privacy-law deletion rights, and providers must keep records for set periods. Other data, such as marketing lists or website and app account details, may still be deletable.

Your legal right to deletion

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, Blueberry Pediatrics generally has to respond to your deletion request within the deadline your state sets. Medical records covered by HIPAA are generally exempt, but other data it holds about you may not be. See what your state's law requires.

Source: California Attorney General breach notice. DataTrail isn't affiliated with Blueberry Pediatrics. This page is general information, not legal advice.