Blueberry Pediatrics Data Breach

Criminals stole a copy of children’s medical records, health plan numbers and birth dates from Blueberry Pediatrics. Two different attackers used the same software flaw, so some families may get two letters about one breach.

Blueberry Pediatrics is a 24/7 virtual pediatric clinic. Families use it for telemedicine visits, often through an employer benefits plan. In its notice letters, the company calls itself “Blueberry Medical.”

On August 22, 2026, Blueberry Medical discovered that criminals had exploited a security flaw in Metabase, a third-party software tool the company uses for reporting and data analysis. According to the notice, the attack led to “the theft of a copy of some Blueberry Medical patient data.”

Blueberry Pediatrics reported the incident to the California Attorney General on October 10, 2026. The notice letters went to parents and guardians, because the patients are children.

How One Software Flaw Led to Two Separate Breaches

Metabase is used by more than 100,000 organizations, according to the notice. In August, Metabase disclosed a previously unknown flaw in its software. The flaw could let an outsider get into a customer’s Metabase system and its data.

Two different criminal actors used that same flaw against two companies that held the same children’s data:

• Blueberry Medical: an attacker got into Blueberry’s own Metabase system and stole a copy of patient data. Blueberry discovered this on August 22, 2026.
• Photon: Photon provides prescription services to Blueberry. A different attacker exploited the same flaw at Photon. According to the notice, the unauthorized access at Photon ran from August 9 through August 12, 2026. Photon received a suspicious email on August 19, patched the flaw on August 21, and told Blueberry on August 24.

Because of this, families may receive more than one notice about what is really one underlying problem. Blueberry says it locked the attacker out within hours, applied the Metabase patch, changed passwords, contacted law enforcement and hired a cybersecurity firm.

About Seven Weeks From Discovery to the California Filing

Blueberry discovered the breach on August 22, 2026. It reported the incident to the California Attorney General on October 10, 2026. That is about seven weeks. The California listing gives breach dates of August 9 and August 10, 2026, so the stolen data may have been in criminal hands for close to two months before families were told.

Blueberry Pediatrics has not disclosed how many children were affected. Neither the California filing nor the notice letters give a total.

Sources: Blueberry consumer notice templates filed with the California Attorney General (oag.ca.gov); California Attorney General data breach listing, reported October 10, 2026.

What Information Was Exposed?

According to the notice, the information taken in the Blueberry Medical incident could include:

• Child’s name
• Date of birth
• Health plan name and policy number
• Health care information, including medical records, dates of service, medical codes and charges for services

The Photon incident involved a subset of the same information:

• Name, street address, phone number, email address or member ID
• Medication information

The notice states that Social Security numbers and payment information were not involved. It also states that photos and videos used by clinicians are stored separately and were not compromised.

What Is Blueberry Pediatrics Offering Families?

The notice letters do not offer credit monitoring or identity protection services. Instead, they point families to free credit reports, fraud alerts and security freezes through the three national credit bureaus.

Families with questions can call Blueberry at 888-752-8498, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, or email [email protected].

Why Stolen Medical Data Is a Risk for Children

A child’s medical records, health plan number and date of birth together form a detailed profile. Criminals can use this kind of data to file false insurance claims or to get medical care in someone else’s name. This is called medical identity theft. It can put false information into a child’s medical record.

Children rarely check their own records, so misuse of a child’s information can go unnoticed for a long time. The stolen contact details also make it easier for scammers to send convincing phishing emails or texts that mention Blueberry, Photon or Metabase by name.

Parents and guardians of affected children can:

• Review every Explanation of Benefits from the child’s health plan for visits or prescriptions that did not happen.
• Call the health plan about any unfamiliar claim.
• Treat any message that mentions this incident with caution, and contact Blueberry only through the number in the letter.
• Ask each credit bureau whether the child has a credit file, and consider a security freeze.
• Keep both notice letters if more than one arrives.

Do Families Have Legal Options?

Healthcare providers that collect children’s medical information have a legal obligation to protect it, including when they share it with technology vendors. When that obligation is not met, affected families may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. Call 206.207.8929 or visit www.emeryreddy.com. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the Blueberry Pediatrics data breach?

Blueberry Pediatrics has not said. The California Attorney General listing and the notice letters do not give a total number of affected children.

What information was exposed?

According to the notice, the information may include:

• Your child’s name
• Date of birth
• Health plan name and policy number
• Medical records, dates of service, medical codes and charges
• For the Photon incident: address, phone number, email address or member ID, and medication information

The notice says Social Security numbers and payment information were not involved.

Why did I get two letters?

Two separate attackers used the same Metabase software flaw. One got into Blueberry’s system. The other got into the system of Photon, Blueberry’s prescription service provider. Each incident can trigger its own letter, even though both trace back to the same flaw.

How long did it take Blueberry to notify families?

Blueberry discovered the breach on August 22, 2026, and reported it to the California Attorney General on October 10, 2026. That is about seven weeks. The California listing puts the breach dates at August 9 and 10, 2026.

What should I do if I received a letter about my child?

• Watch your child’s health plan statements for care your child never received.
• Report any unfamiliar claim to the health plan right away.
• Ask the credit bureaus whether your child has a credit file.
• Be careful with emails, texts or calls that mention this breach.
• Save the letter or letters you received.

Why is a medical data breach serious even without a Social Security number?

Medical records and insurance numbers can be used to bill for care or prescriptions in your name or your child’s name. Unlike a credit card, you cannot cancel a medical history or a date of birth. Errors from medical identity theft can follow a patient into future care.

Do I have a legal claim?

Healthcare providers have a duty to protect patient information and to tell patients promptly when it is exposed. If your child’s information was involved in this breach, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.