Dorsata, Inc.

Dorsata, a health IT vendor for women's health clinics, had its patient database reached between August 10 and 12, 2026 through a flaw in Metabase, the analytics software attached to its platform. Patient names are the only confirmed loss, though the letter's variable data field suggests more for some, and neither the count nor the actor has been named. The security surrounding that PHI turned out to be a reporting tool. Analytics got a direct line into the clinical record, and the protection never followed it there.