Enterprise Account Manager

Blueberry Pediatrics discloses health data theft through Metabase flaw. Blueberry Medical has disclosed a data breach in which an attacker exploited a Metabase vulnerability to steal patient information, including children's medical records and health insurance details. The healthcare provider discovered the unauthorized access on August 22, 2026. A separate public statement places the initial intrusion on August 10, when the attacker gained administrator access to Blueberry's Metabase environment. According to the notification, Blueberry used the business intelligence platform for reporting and data analysis. The attacker exploited a previously unknown vulnerability to access the environment and copy certain patient data. Blueberry operates a pediatric telehealth service that gives families round-the-clock access to board-certified pediatricians through its app. Its service combines remote consultations with an at-home medical kit, allowing parents to submit pictures, videos, and measurements to support diagnosis. Medical and insurance information exposed. The notification includes versions addressed to patients and to parents or guardians of affected children. Information potentially exposed includes: * Full names * Dates of birth * Health plan names and policy numbers * Medical records * Dates of service * Medical codes * Service charges Blueberry says Social Security numbers and payment information were not involved. Photos and videos used by clinicians for diagnosis were stored separately and were not compromised. The disclosed data nevertheless includes sensitive details about patients' healthcare and insurance coverage. Such information could potentially help criminals make fraudulent messages appear credible, particularly if they impersonate a healthcare provider or insurer. Neither the attached notification nor Blueberry's public statement specifies how many patients were affected. Attack exploited an analytics platform. Metabase's own investigation traced the broader incident to August 3, when a cloud customer reported an API key created outside normal working hours. The vendor identified a flaw in its password-reset flow that allowed attackers to inject SQL commands into the application database. In the observed attacks, attackers used this to create an administrator session and an API key that enabled bulk data downloads. Metabase released patched versions on August 6. It later reported that fewer than 3% of its cloud customers were compromised before patching, and that some users were running publicly accessible, self-hosted installations. Blueberry says it terminated unauthorized access and associated sessions within about an hour of detection, preserved evidence, and confirmed its Metabase environment was running a non-vulnerable version by then. It also contacted law enforcement and hired a forensic cybersecurity firm. The company has since strengthened authentication, added monitoring and escalation procedures for critical vendor vulnerabilities, and increased security reviews of third-party and self-hosted infrastructure. Affected families should review healthcare and insurance statements for unfamiliar services and treat unsolicited requests referencing their medical information cautiously. Verify unexpected communications directly with the provider or insurer using established contact details. Blueberry also recommends monitoring account statements and credit reports.

Poppins Payroll data breach investigation: Edelson Lechtzin LLP probes class action claims after customer data is exposed. Oct 02, 2026, 20:52 ET National class action law firm offers free, confidential case evaluations to household employers and household employees whose personal information may have been exposed in the Poppins Payroll data breach. NEWTOWN, Pa., Oct. 2, 2026 /PRNewswire/ - Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the Poppins Payroll data breach. Anyone who received a breach notice, or who believes their personal information was exposed, can request a free case evaluation. Poppins Payroll data breach - at a glance * Company: Poppins Payroll is a Boulder, Colorado-based, cloud-based service for managing household employee payroll and taxes. * Reported: Poppins Payroll sent notification letters dated September 29, 2026, and reported the incident to the California and Vermont Attorneys General beginning September 29, 2026. * How it happened: An unauthorized third party exploited a security vulnerability in Metabase, a software vendor used by Poppins Payroll, to access one of the company's systems. * When: Poppins Payroll detected the unauthorized access on September 3, 2026, and reported that it occurred the same day. * Who may be affected: Household employers who use Poppins Payroll and the household employees paid through its service. * Status: The incident's full nationwide scope and the attacker's identity have not been publicly confirmed. * Cost to you: Nothing. Click here for a free evaluation. What Happened On September 3, 2026, Poppins Payroll detected that an unauthorized third party had gained access to one of its systems after exploiting a security vulnerability in Metabase, a software vendor the company uses. The company addressed the vulnerability, engaged an outside security firm, and determined that affected individuals' personal information may have been accessed or acquired that day. Its filing with the Vermont Attorney General identified 333 affected Vermont residents; the nationwide total has not been publicly confirmed. What Personal Information May Be at Risk Based on public accounts and regulatory filings, the information potentially involved varied by individual. Depending on what each person had provided to Poppins Payroll, the data that may have been compromised includes full name, Social Security number, date of birth, home address, phone number, wage and compensation information, tax return information, direct deposit and other financial account details, and credit and debit account information. Your Legal Options Edelson Lechtzin LLP is investigating a potential class action on behalf of individuals whose personal data may have been compromised. A successful case could recover compensation for losses such as lost time, out-of-pocket costs, and loss of privacy, and could push Poppins Payroll to strengthen how it protects personal information. Anyone who received a breach notification is encouraged to come forward. The firm will evaluate your rights and potential claims at no cost. Recommended Steps to Protect Yourself Enroll in the complimentary protection Poppins Payroll is offering: 24 months of credit monitoring and identity protection through Experian IdentityWorks, using the activation code and deadline in your notification letter. * Preserve any breach letters or emails, and monitor your account statements and credit reports for suspicious activity. Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion. Guard against tax fraud by filing early and requesting an IRS Identity Protection PIN. Be cautious of calls, texts, or emails referencing this breach. The company's notice includes a dedicated call center for questions. Contact Us for a Free Case Evaluation Speak confidentially with a data privacy attorney today: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492; Email: [email protected]; Web: www.edelson-law.com. About Edelson Lechtzin LLP Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud. Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions. Prior results do not guarantee a similar outcome. The data breach described above is based on Poppins Payroll's notification letters and its filings with state regulators; certain details, including the full nationwide scope, remain unconfirmed. SOURCE Edelson Lechtzin LLP