Dorsata, Inc. Informs Patients About Security Breach Related to Metabase Software

Dorsata, Inc., based in Charlottesville, Virginia, has recently reported a significant data security incident affecting the protected health information of its patients. This situation stems from a vulnerability found in the Metabase third-party software that Dorsata utilizes for business intelligence purposes. The issue was identified around August 12, 2026, prompting immediate action from Dorsata.

Upon learning of the security concern, Dorsata swiftly patched the software and initiated a thorough investigation, collaborating with independent cybersecurity experts. The investigation revealed that unauthorized access to the database platform storing sensitive medical information occurred between August 10 and August 12, 2026. Although the data potentially affected includes critical personal information, Dorsata assures that there is currently no evidence that any information has been misused or attempted to be misused.

As of October 21, 2026, Dorsata has begun notifying individuals who may be impacted by this incident. Each notification letter outlines what transpired, as well as providing recipients with resources and recommendations to protect their information moving forward. The compromised data potentially encompasses an individual's name, address, patient ID, date of birth, vital signs, details of treatment, vaccination records, medications, health insurance information, and medical histories recorded in patient files. Importantly, sensitive information such as social security numbers, driver's license numbers, and financial particulars were not involved in the breach.

Dorsata is committed to the utmost security of patient information. In light of this incident, the company is taking proactive measures to prevent similar occurrences in the future. This includes the installation of security patches and updates provided by Metabase for its users. Alongside their notification letters, Dorsata has established a toll-free call center—reachable at 800-655-5832—servicing inquiries related to the incident from 8:00 AM to 8:00 PM ET, Monday to Friday, excluding major holidays.

The protection of health information is paramount for Dorsata, and the company expresses sincere regret for any potential distress this situation may have caused to its patients. Moving forward, Dorsata aims to enhance their cybersecurity measures and strengthen protocols to guard against any future threats to patient data. Dorsata places great importance on transparency and has made significant efforts to inform and assist those potentially affected by this situation, reflecting their commitment to patient care and data security in the healthcare sector.