Almeida Law Group is investigating a data breach at Dorsata, Inc. The breach occurred on August 10th, 2026. If you were affected, contact Almeida Law Group.
About Dorsata, Inc.
Dorsata, Inc. is a healthcare technology company founded in 2011 and headquartered in Arlington, Virginia, with a mailing address in Charlottesville, Virginia. The company provides electronic health record solutions designed specifically for women’s healthcare practitioners, including obstetricians and gynecologists, as well as life sciences organizations and health plans. Its platform is used across more than 300 women’s health practice sites in 20 states, serving over 2,500 clinical users and supporting the care of approximately 1.5 million patients annually. Because Dorsata’s platform is integrated with patient health records, a breach of its systems has the potential to expose sensitive protected health information.
What Happened?
Dorsata, Inc. was listed in a California Attorney General sample breach notice. The incident stems from a critical zero-day SQL injection vulnerability in Metabase, a third-party business intelligence software tool that Dorsata used in connection with its patient database. The vulnerability, tracked as CVE-2026-72898 and rated CVSS 10.0, affected Metabase versions 1.58 and above and allowed unauthenticated remote attackers to gain full administrator access through the password-reset API endpoint. Active exploitation in the wild began around August 3rd, 2026. Metabase publicly disclosed the attacks on August 6th, 2026, and the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on August 11th, 2026.
Dorsata received notice of the vulnerability on August 12th, 2026, immediately patched the software, and engaged third-party cybersecurity experts to investigate. The investigation determined that unauthorized access to Dorsata’s database platform occurred between August 10th, 2026 and August 12th, 2026. The exposed data may have included patient names, addresses, patient IDs, dates of birth, vitals data, treatment information, treatment locations, provider names, vaccines, medications, health insurance information, and medical history contained in patient medical records. Dorsata confirmed that social security numbers, driver’s license numbers, and financial information were not involved. The company states it has no evidence of misuse or attempted misuse of the affected data. Notification letters were sent to affected individuals beginning October 21st, 2026, approximately 70 days after the breach window. Dorsata is not the only organization affected by this vulnerability; Framework, Tally, n8n, and Kilo Code were also reported as victims of the same Metabase exploitation campaign.
Key Facts at a Glance
- Company or Organization: Dorsata, Inc.
- Industry: Healthcare IT / Health Technology (Electronic Health Records for Women’s Health / Obstetrics)
- Location: Arlington, Virginia
- Incident type: Unauthorized access via third-party software zero-day vulnerability (Metabase CVE-2026-72898, SQL injection)
- Date of breach: August 10th, 2026
- Date breach discovered: August 12th, 2026
- Date of consumer notification: October 21st, 2026
- Litigation status: No class action filings related to this incident found as of October 22nd, 2026
- Source: California Attorney General sample breach notice; PR Newswire press release; Health Technology Net coverage; BleepingComputer
What Should You Do?
If you received a notice from Dorsata, consider enrolling in any identity protection services offered in the letter by the stated deadline. Because health information was involved in this breach, review any Explanation of Benefits statements from your health insurer and request copies of your medical records to check for unfamiliar entries. Place a fraud alert or security freeze with one of the three major credit bureaus — Equifax, Experian, or TransUnion — to help prevent unauthorized accounts from being opened in your name. You can obtain a free copy of your credit report from each bureau once every 12 months at AnnualCreditReport.com. Monitor your financial and insurance accounts for unusual activity, and report any suspected identity theft or fraud to the Federal Trade Commission at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
