Almeida Law Group is investigating a data breach at Blueberry Pediatrics. The breach occurred on August 9th, 2026. If you were affected, contact Almeida Law Group.
About Blueberry Pediatrics
Blueberry Pediatrics, operated by SparkMD, Inc., is a pediatric telehealth company headquartered in Mountain View, California. Founded in 2017, the company provides 24/7 on-demand virtual visits with board-certified pediatricians and supplies families with at-home medical kits—including otoscopes, pulse oximeters, and thermometers—to support remote diagnosis and treatment of common childhood illnesses. Blueberry partners with employers, health plans, and managed care organizations such as Carrot Fertility and Meridian Health Plan of Illinois. Because the company delivers healthcare services to children, its records include protected health information belonging to minors.
What Happened?
Blueberry Pediatrics was listed in a California Attorney General sample breach notice reported on October 10th, 2026. The incident actually involved two separate intrusions by two different criminal actors, both exploiting the same critical zero-day vulnerability in Metabase, a widely used open-source business intelligence platform that Blueberry used for reporting and data analysis.
On August 22nd, 2026, Blueberry Medical discovered that an unknown actor had exploited the Metabase vulnerability to gain unauthorized access to its environment and steal a copy of certain patient data. Blueberry locked the unauthorized party out within hours, applied the Metabase patch, and changed affected credentials and security protocols. The company also notified law enforcement and retained a forensic cybersecurity firm.
Separately, on August 24th, 2026, Blueberry was notified that Photon Health, its prescription service provider, had experienced a related but distinct incident caused by a different criminal actor exploiting the same Metabase vulnerability. Photon determined that unauthorized access occurred from August 9th, 2026, through August 12th, 2026, and patched the flaw on August 21st, 2026. Photon publicly disclosed its breach on October 8th, 2026.
Information potentially exposed in the Blueberry incident includes: name, health plan name and policy number, date of birth, and health care information such as medical records, dates of service, medical codes, and charges for services. The Photon-related subset specifically involved name, street address, phone number, email address, member ID, and medication information. The notice confirms that Social Security numbers and payment information were not involved, and that photos and medically necessary videos used for diagnosis were stored separately and were not compromised. Because the affected individuals are pediatric patients, the notice was addressed to their parents and guardians.
The Metabase vulnerability carried a CVSS score of 10.0—the highest possible severity rating—and affected self-hosted instances used by more than 100,000 organizations worldwide. A ransomware group known as Dire Wolf claimed responsibility for the Photon incident on August 19th, 2026, alleging it obtained 63.3 GB of data. This is an attacker-side allegation only; neither Photon nor Blueberry has confirmed Dire Wolf’s involvement, and the breach notice refers only to “unknown actor(s).” Dire Wolf is a financially motivated double-extortion group first observed in April/May 2025, with healthcare accounting for approximately 16 percent of its claimed victims. No prior breaches involving Blueberry Pediatrics or SparkMD were found. A Photon Health breach lawsuit investigation has been opened by at least one law firm, but no filed lawsuits specifically naming Blueberry Pediatrics were identified as of October 12th, 2026.
Key Facts at a Glance
- Company or Organization: Blueberry Pediatrics (operated by SparkMD, Inc.)
- Industry: Pediatric telehealth / digital health
- Location: Mountain View, California
- Incident type: Unauthorized access via third-party Metabase zero-day vulnerability (two separate incidents)
- Date of breach: August 9th, 2026 (Photon incident); August 22nd, 2026 (Blueberry discovery date)
- Date breach discovered: August 22nd, 2026
- Date of consumer notification: October 10th, 2026
- Identity theft protection offered: None (SSNs and payment information were not involved)
- Litigation status: No filed lawsuits naming Blueberry Pediatrics found as of October 12th, 2026; Blueberry’s Terms of Use include a binding arbitration clause and class action waiver
- Source: California Attorney General breach filing · PR Newswire – Photon Notice of Data Security Incident · ClaimDepot – Photon Health Data Breach Investigation · DashboardFox – Metabase Breach · Proven Data – Dire Wolf Ransomware profile
What Should You Do?
Although Social Security numbers and financial data were not exposed, the breach did involve health information belonging to children, and you should take steps to protect your family. Review Explanation of Benefits statements from your health plan and compare them against actual medical visits and prescriptions to spot any unfamiliar entries. Monitor your children’s medical records for services or medications that were never provided. You can also place a fraud alert or credit freeze on your child’s credit file—even if they do not have an active credit history—by contacting any of the three major credit bureaus. Obtain free annual credit reports at AnnualCreditReport.com and review all account statements regularly. If you suspect misuse of your child’s information, visit IdentityTheft.gov for step-by-step guidance on reporting and recovery.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
