The Blueberry Pediatrics breach: what was taken, and what parents should do
Parents signed up for quick access to a pediatrician from home. In August an attacker copied the medical records of 340,915 patients, most of them children. Here is what was in the file, what was not, and the few steps that actually protect a child.
In August 2026 an attacker used a flaw in Metabase, a reporting tool, to copy patient data from Blueberry Pediatrics, a children’s telemedicine service. The company told regulators 340,915 people are affected. The copy holds names, dates of birth, insurance policy numbers, medical records, diagnosis codes and charges, but no Social Security numbers or payment details. There is no online lookup; letters started going out around 9 October. Parents should freeze their child’s credit, read insurance statements, and be wary of messages that use Blueberry’s name.
What is confirmed, and what is still open
The middle column is what Blueberry Pediatrics and Photon have said in their notices. The right column adds press reporting and notes what the companies have left unsaid.
| Question | What the notices say | Detail and open questions |
|---|---|---|
| What happened | Someone exploited a flaw in Metabase, a data-reporting tool Blueberry used, and took a copy of patient data. Blueberry found out on 22 August 2026 and says it cut off the access within about an hour. | CyberInsider, citing a separate Blueberry statement, says the intruder first got in on 10 August 2026. The attacker has not been named. |
| How many people | 340,915, the figure Blueberry gave the Oregon Attorney General. | Texas filings list 60,581 and 7,249 Texas residents. HIPAA Journal said on 28 October that the case was not yet on the federal HHS breach portal. |
| What was taken | Names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes and charges for services. | Whether parents’ own details, beyond their child’s insurance policy, were in the copy has not been spelled out. |
| What was not taken | Social Security numbers and payment information. Photos and videos families uploaded for consultations are stored separately and were not touched. | Nothing disputed. |
| A second incident | Photon, Blueberry’s prescription service, was hit through the same Metabase flaw by a different attacker between 9 and 12 August, and told Blueberry on 24 August. Its data includes addresses, phone numbers, emails, member IDs and medication details. | Some families may get two letters, one for each incident. |
| Letters and lawsuits | Letters started going out around 9 October 2026, with a call centre on 888-752-8498. | Law firms, including AWKO Law on 3 November, are advertising investigations. No settlement exists. |
Sources: Blueberry Pediatrics’ notices to the Oregon, California and Texas attorneys general as reported by The HIPAA Journal (28 October 2026), CyberInsider (13 October 2026) and Claim Depot (26 October 2026); AWKO Law’s announcement on Business Wire (3 November 2026). Status as of 4 November 2026.
1. What happened, in order
Blueberry Pediatrics used Metabase, a popular tool for building reports from a database. In early August 2026 Metabase found a serious flaw and released a fix on 6 August. Before Blueberry’s copy was patched, someone used the flaw to get administrator access, and on 22 August Blueberry noticed and shut it down. By then a copy of patient data had been taken. Two days later Photon, the service Blueberry uses for prescriptions, reported that a different attacker had used the same flaw against its own Metabase. Letters to families began around 9 October.
2. Why a child’s medical record is worth stealing
Adults notice when someone opens a credit card in their name. Children do not, often until they apply for a student loan or a first phone contract years later. A name, a date of birth and a health insurance policy number are enough to start building a fake identity or to bill an insurer for care that never happened. That is why this breach is worth twenty minutes of a parent’s time even though no Social Security numbers were taken.
3. The honest answer to “is my child in it”
There is no lookup. The data has not shown up in the known breach databases that email checkers search. The letter is the answer, and some families will get two: one from Blueberry, one about the Photon incident. If you cancelled your subscription a while ago, the records can still be in scope, because a provider keeps medical records long after the last visit.
4. Freeze your child’s credit
Ask Equifax, Experian and TransUnion to create and freeze a file for your child. It is free for children under 16, it needs a birth certificate, the child’s Social Security card and proof of guardianship, and it stays until you lift it. While you are at it, ask each bureau whether a credit file already exists for your child. A child should not have one, so any file at all is a warning sign. Our guide to removing your child’s information covers the rest of what is public about kids.
5. Check the insurance statements
The policy number was in the data, so the place misuse would show up first is your health insurer. Read the explanation-of-benefits statements for your child for the next several months and look for visits, prescriptions or equipment you do not recognise. Report anything odd to the insurer. Our guide to medical data breaches explains medical identity theft and how to dispute a bill.
6. The messages that come next
Expect fake messages that use Blueberry’s name: a text asking you to log in and “verify” your child’s account, a call from a “pediatric billing office” that already knows your child’s birthday, an email offering compensation if you fill in a form. Check anything that asks for information or money through the app or the number on the letter. Our guide to telling a real breach letter from a fake shows what a genuine notice looks like.
Your family’s address is probably public already
You cannot search the stolen records. You can search the people-search sites that list your home address, phone number and household members, which is where a scammer who knows your child’s birthday goes next. PersProtect looks for your details on those sites, checks your email against known breach databases, and files the removals.
Check my exposure — free →The Blueberry Pediatrics breach, answered
What is Blueberry Pediatrics?
A pediatric telemedicine subscription. Parents get app access to board-certified pediatricians and an at-home medical kit, so they can send photos, videos and measurements during a consultation. The company also appears as Blueberry Medical in some notices.
I got a letter about my child’s data. Is it real?
Blueberry started mailing letters around 9 October 2026, with versions addressed to patients and to parents or guardians of affected children. The call centre listed in reporting is 888-752-8498, Monday to Friday, 9 a.m. to 9 p.m. Eastern. Before acting on any letter, email or call, compare the contact details with the ones in your Blueberry account or app. A genuine notice does not ask you to pay anything or read out a Social Security number.
Was my child’s Social Security number exposed?
Blueberry says no. Social Security numbers and payment information were not involved, and the photos and videos you uploaded were stored separately and not affected. What was taken is medical: names, dates of birth, insurance details, records of visits, diagnosis codes and charges.
Can I check online whether my child was in it?
No. The stolen data has not appeared in the known breach databases that email checkers search, and records about children are rarely tied to an email address anyway. If your family had a Blueberry subscription before late August 2026, assume your child may be among the 340,915 and look for the letter.
Should I freeze my child’s credit if no SSN was taken?
It is still worth doing. A child’s name, date of birth and insurance policy number are a start for anyone building a fake identity, and a child’s credit file is the one nobody checks for years. A freeze at Equifax, Experian and TransUnion is free for children under 16, needs the child’s birth certificate and Social Security card plus proof that you are the parent or guardian, and stays until you lift it.
Is there a Blueberry Pediatrics class action?
Law firms began advertising investigations in October and early November 2026. That means they are collecting clients, not that a settlement exists. You do not need to sign up with anyone to keep your rights; if a settlement is reached, eligible families are notified and can claim then.
The records are out. You can still shrink what is public.
See which people-search sites publish where your family lives and how to reach you. It is free and takes about a minute.
Run my free exposure scan →