Hackers copied health records for about 341,000 Blueberry Pediatrics patients through a flaw in a data tool. Many families may get two breach notices.
Hackers stole a copy of patient records from Blueberry Pediatrics, a telemedicine service that gives subscribers access to board-certified pediatricians. About 341,000 people are affected, according to a report to the Oregon Attorney General. The stolen files include medical records and health insurance details, which scammers can misuse.
The way in was a flaw in Metabase, a tool companies use to organize and view their data. More than 100,000 organizations use it. Blueberry Pediatrics learned on August 22, 2026, that a hacker had used the flaw to copy patient data. The company says it fixed the flaw within hours, but the hacker already had the data.
A second problem followed. Photon, a prescription service that Blueberry Pediatrics uses, also ran Metabase. On August 24, 2026, Photon told Blueberry Pediatrics that a different hacker had used the same flaw and copied patient data there too.
From Blueberry Pediatrics, the stolen information includes:
People affected through Photon may also have had addresses, phone numbers, email addresses, member IDs and medication information exposed.
Social Security numbers and financial information were not involved, according to the company. Photos and videos that patients uploaded were stored separately and were not taken. That lowers the risk of direct bank fraud or identity theft built on a Social Security number. It does not remove the risk from exposed health details.
Health data is hard to change. A child's date of birth, insurance number and care history stay the same for years. Criminals can use them to send convincing fake bills, make calls that sound like a real provider, or try to bill an insurance plan for care that never happened. Details about medications can make a scam call sound believable.
The alert box above lists the steps. The short version is to watch for notices, check insurance statements closely, and be careful with anyone who contacts you about your child's care.
Because the same data was exposed in more than one incident, some families are likely to get more than one breach notice. The breach does not yet appear on the federal health department's breach portal. Texas received two reports, covering 60,581 and 7,249 residents. Blueberry Pediatrics says it changed passwords, strengthened sign-in controls, and added more monitoring and security reviews for vendor flaws.
If your child used Blueberry Pediatrics, expect a breach notice and check insurance statements for charges you do not recognize.
Reports say the Trump administration is weighing underwater datacenters off Maine and Alaska, and Lake Erie groups want a plan before anyone proposes one nearby.
Read more: Underwater datacenters may be next, and Lake Erie groups are worriedA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
