Short answer
Dorsata, a Charlottesville, Virginia health technology company, says a security vulnerability in Metabase, a third-party business intelligence tool it uses, allowed unauthorized access to a database of medical information for patients of its provider partners between 10 and 12 August 2026. Letters began on 21 October 2026.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Dorsata, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare technology (clinical software for provider practices) |
| Country | United States |
| Detected | 2026-08-12 |
| Disclosed | 2026-10-21 |
| People or records affected | Not stated by Dorsata |
What data was exposed
- Name, address, patient ID and date of birth
- Vitals, treatment information, treatment location and provider name
- Vaccines, medications and medical history from medical records
- Health insurance information
What happened
Dorsata supplies software to healthcare providers. In a notice on its website, the company says that on or about 12 August 2026 it received notice that Metabase, a third-party business intelligence tool it uses, contained a security vulnerability. It installed the security patches and updates Metabase provided and investigated with outside cybersecurity experts.
The investigation found that the vulnerability allowed unauthorized access to a database holding medical information for patients of Dorsata’s healthcare provider partners between 10 and 12 August 2026. Dorsata says it has no evidence of misuse or attempted misuse of any potentially affected information.
What data was involved
According to the notice, the information may include name, address, patient ID and date of birth. It may also include vitals, treatment information, treatment location, provider name, vaccines, medications, health insurance information and medical history from medical records. Dorsata states that Social Security numbers, driver’s license numbers and financial information were not involved.
Dorsata has not said how many people are affected, and it has not named the provider partners whose patients are included. Its press release says letters began on 21 October 2026, and the California Attorney General’s list shows a Dorsata filing reported on 21 October with breach dates of 10 and 12 August.
What Dorsata is doing
Beyond patching the software, Dorsata set up a toll-free call center on 800-655-5832, open Monday to Friday, 8 a.m. to 8 p.m. Eastern, excluding major holidays. The notice points to free credit reports, fraud alerts, security freezes and Federal Trade Commission identity theft guidance. We did not see a credit monitoring offer in the notice.
What is still unknown
- how many people received letters;
- which provider practices are involved;
- how Dorsata received notice of the vulnerability, which the notice does not say;
- whether the data has been published or sold. We found no claim in the sources reviewed.
Staying safe
Medication, vaccine and insurance details are the kind of facts a scammer uses to sound like a clinic or insurer. Our guide to health insurance and Medicare scams covers fake plan calls, phishing messages shows how to check a sender, and what to do after a data breach covers freezes and monitoring.
Photon Health reported a similar Metabase flaw, covered in our Photon Health post. More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or texts that mention a real medication, vaccine or visit to sound like your clinic, pharmacy or insurer
- Fake messages offering 'free credit reports' or monitoring through a link you did not ask for
- Insurance scams that use your insurer's name and plan details to ask for payment or a verification code
- Impersonators claiming to be Dorsata's call center to collect identity details
What to do if you are affected
- 01Read the Dorsata letter when it arrives and keep it. It does not list a monitoring offer in the notice we reviewed, so rely on the steps in the letter itself.
- 02Review insurance explanation-of-benefits statements for services or prescriptions you did not receive, and report them to your insurer or provider.
- 03Call Dorsata's toll-free call center on 800-655-5832 (Monday to Friday, 8 a.m. to 8 p.m. Eastern) if you want to confirm a message or letter.
- 04Order your free credit reports at annualcreditreport.com and consider a free credit freeze or fraud alert.
- 05Do not share verification codes, Social Security numbers or payment details with anyone who contacts you about this incident.
Frequently asked questions
Why did I get a letter from Dorsata?
Dorsata supplies software to healthcare provider partners. If one of those providers holds your records on the platform, your information may have been in the affected database even if you never dealt with Dorsata directly.
What was the vulnerability?
A security vulnerability in Metabase, third-party business intelligence software Dorsata uses. Dorsata says it received notice of the problem on or about 12 August 2026 and installed the patches Metabase provided.
Were Social Security numbers taken?
Dorsata says Social Security numbers, driver's license numbers and financial information were not involved.
Is the data being misused?
Dorsata says it has no evidence of misuse or attempted misuse of the potentially affected information.
Is this the same as the Photon Health incident?
Both organizations say a Metabase vulnerability was involved, but they are separate notices with different dates and data. Photon Health reported access on 9 and 10 August, and Dorsata on 10 to 12 August. Neither notice says the incidents are linked.
Sources
- 2026 Metabase Security Incident, Dorsata (organization notice), 2026-10-21
- Dorsata, Inc. Notifies Patients of Metabase Data Security Incident, PR Newswire (Dorsata press release), 2026-10-21
- Search Data Security Breaches, Dorsata, Inc. (reported 10/21/2026), California Attorney General, 2026-10-21
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.