Families of Blueberry Pediatrics patients may be covered by proposed class actions alleging Blueberry Medical and software maker Metabase failed to protect children’s health information stolen through a Metabase vulnerability in August 2026. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Blueberry Medical and Metabase have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Blueberry Pediatrics is a pediatric telehealth service operated by SparkMD, Inc. and Blueberry Medical. In October 2026 it began notifying parents that their children's health information had been stolen through a security flaw in Metabase, a business-intelligence tool Blueberry used for reporting and data analysis. On October 19, 2026, proposed class actions were filed in the U.S. District Court for the Northern District of California against Metabase, Inc. and Blueberry's operators.Law360 reported one of the suits as Pulliam v. Metabase, Inc., No. 3:26-cv-12138, a proposed negligence class action alleging the defendants failed to protect patients' personal health information and waited several weeks to notify the people affected. A second suit, Chasapis v. SparkMD, Inc., No. 5:26-cv-12116, was filed the same day in the same court against SparkMD, Blueberry Medical of California and Metabase, according to its docket listing. The defendants have not responded in court, and the claims are unproven.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Breach
According to the notice Blueberry Medical filed with the California Attorney General, Blueberry discovered on August 22, 2026 that a criminal had exploited a previously unknown vulnerability in Metabase, a tool the notice says is used by more than 100,000 organizations, and had stolen a copy of some patient data from Blueberry's Metabase environment. Blueberry says it locked the intruder out within hours, applied Metabase's patch, changed passwords and contacted law enforcement.The notice describes a second, related incident. Photon, Blueberry's prescription service provider, was hit by a different attacker exploiting the same Metabase flaw, and told Blueberry on August 24, 2026. Photon determined that patient data was taken during unauthorized access from August 9 through August 12, 2026. That incident exposed a subset of the same patients' information, so some families may receive more than one letter.
The letters do not offer credit monitoring or identity protection services. Blueberry says the incident did not involve financial information that would increase the risk of identity theft. Blueberry has not published how many patients were affected.
What the Lawsuits Claim
The suits are proposed class actions on behalf of patients whose information was exposed. According to Law360's report on the Pulliam case, the plaintiffs allege the defendants failed to protect patients' personal health information from the cyberattack and delayed notifying the people affected for several weeks. Blueberry says it discovered the incident on August 22, and its letters to families were filed with the California Attorney General in October.The full complaints, including their specific claims and proposed class definitions, were not available when this page was published.
The same Metabase vulnerability is behind the Poppins Payroll data breach lawsuits filed in Colorado.
What Happens Next
The defendants have not yet responded. Related suits filed in the same federal district are often consolidated before the court rules on any motion to dismiss. The cases are at the complaint stage, so there is no settlement, no claim form and no deadline for affected families.Questions
What information was taken in the Blueberry Pediatrics data breach?
According to Blueberry Medical's notice letter, the stolen data could include a child's name, date of birth, health plan name and policy number, and health care information such as medical records, dates of service, medical codes and charges. Blueberry says Social Security numbers, payment information, and the photos and videos families send for diagnosis were not involved.
Why did some families get two Blueberry Pediatrics breach letters?
Blueberry's notice says Photon, its prescription service provider, had a separate incident caused by a different attacker exploiting the same Metabase vulnerability, which exposed a subset of the same patients' information, such as names, contact details or member IDs and medication information. Families may receive a notice for each incident.
Is Blueberry Pediatrics offering credit monitoring?
The notice letter filed with the California Attorney General does not offer credit monitoring or identity protection services. It points families to free credit reports, security freezes and fraud alerts.
Is there a Blueberry Pediatrics settlement to claim?
No. The lawsuits were filed on October 19, 2026 and are at the complaint stage. No class has been certified, and there is no settlement, claim form or deadline.
How many people were affected by the Blueberry Pediatrics data breach?
Blueberry Medical has not published a total. Its notice to the California Attorney General and its letters to families do not give a number of affected patients.
Sources
- Blueberry Medical notice of security incident, template consumer notice filed with the California Attorney General, October 2026
- Law360 — "Metabase, Pediatric Telehealth Biz Sued Over Patient Info Leak," October 20, 2026, reporting Pulliam v. Metabase, Inc., No. 3:26-cv-12138 (N.D. Cal.)
- Docket listing, Chasapis v. SparkMD, Inc., No. 5:26-cv-12116 (N.D. Cal. filed October 19, 2026)
- CyberInsider — report on the disclosure and the Metabase vulnerability, October 13, 2026
