AWKO Law LLP is investigating a data breach that led to unauthorized access to the sensitive information of 340,915 patients of SparkMD, Inc., which does business as Blueberry Pediatrics, a California-based telemedicine service provider that offers subscribers access to board-certified pediatricians.
On August 22, 2026, Blueberry Pediatrics discovered it was impacted by a vulnerability in the third-party business intelligence and data visualization platform Metabase. After an investigation, Blueberry Pediatrics learned that an unauthorized actor may have gained access to patient data. On August 24, 2026, Photon, a prescription service provider used by Blueberry Pediatrics, notified Blueberry Pediatrics that a different unauthorized actor exploited the Metabase vulnerability to gain access to Photon’s data, which included the data of Blueberry Pediatrics patients.
Although the breach occurred in August 2026, Blueberry Pediatrics did not begin sending notifications until October 2026, which may have violated state and federal laws. The following data may have been compromised in the breach: names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and charges for services.
If your personal information was impacted by this incident, you may be at risk of identity theft and other serious violations of your privacy. As a result, you may be entitled to money damages and an injunction requiring changes to Blueberry Pediatrics’ cybersecurity practices.
If you received notification of this data breach or are a patient of Blueberry Pediatrics and wish to obtain additional information about your legal rights, please contact us today at (415) 251-6804 or sdixit@awkolawllp.com.
View source version on businesswire.com: https://www.businesswire.com/news/home/20261103123174/en/
Media gallery
