Dorsata Notifies Patients After Metabase Vulnerability Exposed Health Data

What the notice says

Dorsata, Inc. notified individuals, through a letter filed with the California Attorney General and reported on 2026-10-21, of a data security incident tied to a third-party software vendor. Dorsata, Inc. described the matter as . According to the notice as filed, Dorsata, Inc. .

The notice states that on August 12, 2026, Dorsata, Inc. received word that the Metabase business intelligence software contained a security vulnerability, and that an investigation found . Dorsata, Inc. said names and other data tied to individuals may have been involved, while specifying that social security numbers were not part of the exposed information. Dorsata, Inc. also stated .

What the notice leaves open

The notice as filed does not state how many individuals were affected overall, nor does it specify every category of information involved beyond names, since that section of the template letter relies on variable fields. The document does not say how the vulnerability was identified or by whom, and it does not describe the total scope of the affected database platform beyond Dorsata, Inc.'s own systems.