Dorsata Healthcare Breach: Metabase Zero-Day Exploited, 58,249 Patients Exposed

The Dorsata healthcare breach exposed clinical and demographic records for 58,249 patients after attackers exploited a maximum-severity zero-day vulnerability in self-hosted Metabase analytics software.

Dorsata, Inc., a Charlottesville, Virginia vendor that builds prenatal and OB-GYN workflow software for women’s health practices, confirmed the intrusion in a November 9 PR Newswire notice. The company also filed sample breach notices with state regulators, including the California Attorney General’s Office. Subsequent reporting by The HIPAA Journal on November 13 put the total number of affected patients at 58,249.

Unauthorized access to Dorsata’s database platform occurred between August 10 and August 12, 2026. Dorsata said it learned of the Metabase flaw on or about August 12 and applied vendor patches immediately. External cybersecurity specialists were then brought in to determine which database tables were reached during that 48-hour window. The company added that it has found no evidence of any misuse or attempted misuse of the exposed records.

How Attackers Exploited Metabase CVE-2026-72898

The Dorsata healthcare breach stems from CVE-2026-72898, a CVSS 10.0 unauthenticated SQL injection flaw in Metabase’s password-reset endpoint, POST /api/session/reset_password. Because that route handles unauthenticated requests by design, remote attackers needed no valid login or session cookie to reach it. Threat actors did not even need access to a valid user’s email inbox to weaponize the bug.

Security advisories from Metabase show that the reset endpoint failed to sanitize user-supplied input before querying the application database. Crafted SQL payloads sent to /api/session/reset_password allowed attackers to run arbitrary queries against Metabase’s internal metadata store. From there, adversaries could seize administrative control of the BI server and pivot into connected clinical databases.

With administrative access to Metabase, an intruder can inspect saved SQL questions, read stored connector strings, and run direct queries against linked PostgreSQL or MySQL warehouses. Threat intelligence firms including Bishop Fox and Dataminr noted active in-the-wild exploitation of CVE-2026-72898 as soon as the reset-endpoint bug surfaced. Automated scanners began probing internet-exposed BI ports almost immediately.

Because reporting tools pull data from multiple clinics into one analytics layer, a single compromised BI container can expose records across dozens of partner practices. Unlike ransomware attacks that encrypt files and halt clinic operations, SQL injection leaves web portals running normally while records are queried out over HTTPS. We saw similar database-layer harvesting in the UT Arlington MachForms breach and the City of Osaka Arara supply-chain leak.

Vendor advisories confirm CVE-2026-72898 was actively exploited as a zero-day before patches shipped across self-hosted Metabase branches. Metabase Cloud customers received automatic server-side fixes from the vendor. Self-hosted deployments remained vulnerable across six major release branches prior to August 2026 patches:

• Metabase 0.58.0 through 0.58.23 are affected before patching.
• Metabase 0.59.0 through 0.59.20 are affected before patching.
• Metabase 0.60.0 through 0.60.16 are affected before patching.
• Metabase 0.61.0 through 0.61.10 are affected before patching.
• Metabase 0.62.0 through 0.62.8 are affected before patching.
• Metabase 0.63.0 through 0.63.4 are affected before patching.

What Patient Information Was Exposed in the Dorsata Breach

Dorsata’s platform stores clinical records for partner women’s health clinics and physicians across multiple states. Because obstetric and gynecological care spans months of recurring appointments, those reporting tables combine basic patient identifiers with ongoing clinical histories. The exact mix of exposed fields varies by patient and clinic.

In its PR Newswire notice and state Attorney General filings, Dorsata listed the following data elements as potentially involved:

• Full patient names, residential addresses, patient IDs, and dates of birth were potentially exposed.
• Clinical vitals, treatment details, treatment locations, and provider names were included in affected tables.
• Vaccination records, medications, health insurance details, and medical history notes were also present.

Dorsata confirmed that Social Security numbers, driver’s license numbers, and payment card or banking details were not involved. The company also stated that its investigation has found no evidence of actual or attempted misuse of the exposed records. Affected patients who received letters are being directed to dedicated call-center support and credit-monitoring resources outlined in their notices.

Notification Timeline and HIPAA Filing Window

After patching the Metabase software around August 12, Dorsata spent roughly two months mapping impacted clinic tables and verifying patient addresses. Written notification letters began going out on October 21, 2026. The company followed up with its November 9 PR Newswire press release and state regulatory filings, including a sample notice submitted to the California Attorney General under the state’s 500-resident disclosure threshold.

Under the federal HHS HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals and regulators within 60 days of discovering a breach involving 500 or more people. Federal summaries are later published on the HHS OCR Breach Portal. Third-party clinical software exposures of this scale echo earlier disclosures in the Quest Diagnostics Quanum breach and the Conduent data breach notice.

What Admins and Patients Should Check Now

For organizations running self-hosted Metabase instances from the 0.58 through 0.63 branches, applying the patch alone does not evict an attacker who already gained admin access. Metabase urges administrators with internet-facing servers to inspect access logs for unexpected POST /api/session/reset_password requests. Teams should also audit the internal core_user table for unauthorized administrator accounts and revoke any unfamiliar API keys.

Database credentials and Metabase encryption keys should be rotated wherever a BI node could reach production tables. Placing analytics consoles behind a VPN or identity-aware proxy removes direct public exposure to unauthenticated API routes. Limiting BI connectors to read-only views without raw patient identifiers also reduces the fallout if another reporting flaw emerges. Security teams should also confirm that automated backups of internal Metabase metadata were not exposed to external storage buckets.

Patients who receive a notification letter from Dorsata or their OB-GYN clinic should review the assistance instructions included in the mailing. Because insurance details and treatment histories were exposed without Social Security numbers, medical identity fraud is the primary risk. Checking Explanation of Benefits statements and clinic billing portals for unfamiliar claims over the next year remains the most practical step.