The HIPAA Journal has reported a cluster of newly disclosed healthcare data breaches, and one of them should be a wake-up call for every security team supporting a healthcare organization or healthcare SaaS vendor: Dorsata, a Virginia-based healthcare technology company, disclosed a breach affecting approximately 58,000 patients, and the root cause traces back to an unpatched vulnerability in Metabase — the popular open-source business intelligence and analytics platform. The same disclosure round includes incidents at Bay Area Psychological Consultants, a Florida mental healthcare provider, and Lansing Urgent Care in Michigan, underscoring how relentlessly the healthcare sector is being squeezed from every angle.
For defenders, the Dorsata incident is the analytically important one. This was not a zero-day. This was a known vulnerability in a known product that sat unpatched long enough for an attacker to find it, exploit it, and access protected health information (PHI). That is a patch management and asset visibility failure before it is anything else — and it is exactly the class of failure that regulators, OCR investigators, and plaintiff attorneys treat harshly.
What Happened
Dorsata builds software used by healthcare providers, which makes it a business associate under HIPAA. When a business associate is breached, the blast radius extends to every covered entity it serves — which is how a single vulnerable analytics server turns into 58,000 breach notification letters across multiple provider organizations.
The reported attack chain is depressingly familiar:
- A Metabase instance was deployed and left unpatched, exposing a known, documented vulnerability to the internet or to a broadly reachable internal network segment.
- The attacker exploited the known flaw to gain code execution or unauthorized access on the Metabase host.
- From the analytics layer, the attacker reached data stores — the entire reason Metabase exists is to hold credentials to, and query, production databases. A compromised BI platform is a compromised data platform.
- PHI belonging to roughly 58,000 patients was exposed, triggering HIPAA breach notification obligations for Dorsata and its covered-entity clients.
The companion breaches at Bay Area Psychological Consultants and Lansing Urgent Care reinforce the pattern: healthcare entities of every size, and their technology suppliers, remain the highest-value-per-record target in the criminal economy. Mental health records in particular carry extreme sensitivity and extortion value.
Technical Analysis: Why Metabase Is a High-Value Target
Metabase is a Java-based analytics platform typically deployed as a single JAR (java -jar metabase.jar) or Docker container, fronted by its built-in web server on port 3000 by default. It holds a privileged position in any architecture:
- It stores database connection credentials for every data source it analyzes — frequently production databases containing PHI.
- It is often deployed by data or product teams, not security teams, which means it routinely escapes asset inventories, vulnerability scans, and patch cycles.
- It is frequently internet-exposed so clinicians, executives, or customers can reach dashboards remotely.
- It runs as a long-lived JVM process, which means successful exploitation typically presents as the Java process suddenly spawning shell commands, downloaders, or scripting interpreters.
Historically, Metabase has patched severe pre-authentication remote code execution flaws — bugs that allow an unauthenticated attacker to achieve command execution on the host. When a vulnerability of that class is announced, exploit code follows within days, and mass scanning of internet-facing instances follows within hours. Any instance still running a vulnerable build weeks or months later is effectively an unlocked door with a sign on it.
From a defender's perspective, the exploitation requirements are trivial: network reachability to the Metabase web interface. No credentials, no phishing, no insider access. That is precisely why business intelligence and analytics platforms — Metabase, Tableau, Power BI gateways, Superset — belong on your highest-priority attack surface inventory.
The Business Associate Multiplier
Under HIPAA, Dorsata's clients (the covered entities) are also on the hook: they must ensure their own patients are notified, and OCR will scrutinize whether business associate agreements, risk analyses, and vendor oversight were adequate. If your organization is a covered entity, your vendor inventory needs to answer one question today: which of our business associates run analytics or BI tooling against our patients' data, and who verifies their patch posture?
Detection & Response
The highest-fidelity detection for Metabase exploitation is behavioral: the Metabase JVM should never spawn shells, downloaders, or reconnaissance tools. Any child process of the Metabase Java process is a critical-severity event.
---
title: Metabase Java Process Spawning Shell or Scripting Interpreter
tag: SA-MB-001
id: 3f8a2c71-9b4d-4e6a-b1c5-7d2e9f0a1b3c
status: experimental
description: Detects the Metabase JVM (java running metabase.jar) spawning command shells, scripting engines, or download utilities — a high-fidelity indicator of post-exploitation command execution on the Metabase host.
references:
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.initial_access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentCommandLine|contains:
- 'metabase.jar'
- 'metabase'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare legitimate administrative automation on the Metabase host
level: critical
---
title: Metabase Java Process Spawning Shell on Linux
tag: SA-MB-002
id: 8c1d4e52-6f3a-4b7c-9d2e-5a8f1c3b6e9d
status: experimental
description: Detects the Metabase JVM spawning interactive shells or common post-exploitation utilities on Linux hosts, consistent with exploitation of an internet-facing analytics platform.
references:
- https://attack.mitre.org/techniques/T1190/
- https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentCommandLine|contains:
- 'metabase.jar'
- 'metabase'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/perl'
- '/nc'
- '/ncat'
- '/base64'
condition: selection_parent and selection_child
falsepositives:
- Container health-check scripts in hardened Docker deployments (tune to image)
level: critical
---
title: Suspicious Requests to Metabase Setup and API Endpoints
tag: SA-MB-003
id: 5b2e7f18-3c9d-4a6e-8f1b-2d4c7a9e0b5f
status: experimental
description: Detects inbound web requests targeting Metabase setup and administration API endpoints from external or untrusted sources, indicating reconnaissance or exploitation attempts against internet-facing instances.
references:
- https://attack.mitre.org/techniques/T1190/
- https://attack.mitre.org/techniques/T1595.002/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.initial_access
- attack.t1190
- attack.reconnaissance
- attack.t1595.002
logsource:
category: webserver
detection:
selection_uri:
cs-uri|contains:
- '/api/setup'
- '/api/session/properties'
- '/api/database'
- '/api/user/current'
selection_status:
sc-status:
- 200
- 201
condition: all of selection_*
falsepositives:
- Legitimate administrator setup activity during initial deployment
- Internal monitoring polling session properties
level: high
For Sentinel and Defender environments, hunt for the process-execution behavior across both Windows and Linux telemetry. Even if your Metabase host is a Linux container, the process events flow into Sentinel via Syslog or the Defender for Endpoint Linux agent:
// Hunt: Metabase JVM spawning suspicious child processes (Windows + Linux via Defender)
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessCommandLine has_any ("metabase.jar", "metabase")
or ProcessCommandLine has_any ("metabase.jar")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "curl.exe",
"sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
AccountName, RemoteIP, ReportId
| order by TimeGenerated desc;
// Hunt: Web requests to Metabase setup/admin API via proxy or firewall CEF ingestion
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where RequestURL has_any ("/api/setup", "/api/session/properties", "/api/database")
| where RequestURL has "metabase" or DestinationPort == 3000
| summarize RequestCount = count(), DistinctSources = dcount(SourceIP)
by SourceIP, RequestURL, DestinationHostName, bin(TimeGenerated, 1h)
| where RequestCount > 3 or DistinctSources > 2
| order by TimeGenerated desc;
For endpoint forensics on a suspected Metabase host, Velociraptor can rapidly confirm whether the JVM has been launching anything it shouldn't, and whether it holds unexpected outbound connections:
-- Hunt: Identify Metabase JVM processes, their children, and their network connections
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'metabase'
OR Name =~ 'java'
-- Correlate with live network connections for the Metabase process
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ 'java'
AND Raddr.IP !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
The netstat filter intentionally surfaces only non-RFC1918 remote addresses — a Metabase JVM holding outbound connections to public IPs is almost never legitimate and warrants immediate triage.
Remediation
If you operate Metabase — in healthcare or any sector — treat this as an action item this week, not this quarter.
1. Inventory every Metabase instance. Query your EDR, CMDB, cloud inventories, and external attack surface monitoring for port 3000 listeners, metabase.jar processes, and Metabase Docker images. Ask data and product teams directly — shadow BI deployments are the norm, not the exception.
2. Patch to the latest release immediately. Metabase publishes fixes on both the open-source and enterprise tracks. Verify your running version against the current release and the project's published security advisories:
#!/bin/bash
# Metabase patch posture and exposure audit — run on the Metabase host
# 1. Identify the running Metabase process and version
ps aux | grep -i [m]etabase
# 2. Query the local instance for its version tag
curl -s http://localhost:3000/api/session/properties | grep -o '"version":{[^}]*}'
# 3. Check whether the instance is reachable from outside the host
ss -tlnp | grep -E '3000|java'
# 4. Verify the application database is not exposed on a public interface
ss -tlnp | grep -E '5432|3306|1433'
# 5. Confirm egress: Metabase should only reach its data sources and Metabase's update service
sudo iptables -L OUTPUT -n -v | head -30
Upgrade to the latest stable build from the official Metabase release channels, and subscribe to the project's security advisories on GitHub so the next disclosure doesn't catch you flat-footed. Where an upgrade window cannot be scheduled immediately, restrict network access to the instance to an allowlist of administrator source IPs at the load balancer or security group layer — that removes the unauthenticated remote attack path entirely.
3. Remove internet exposure. Metabase should sit behind an authenticated reverse proxy, VPN, or identity-aware proxy (e.g., Entra ID app proxy, Cloudflare Access). There is no defensible reason for a raw Metabase web interface to answer the public internet.
4. Rotate credentials the instance holds. If there is any chance of compromise — or if the instance was internet-facing and unpatched for an extended period — rotate every database credential stored in Metabase, audit database query logs for anomalous read volume (bulk PHI extraction tends to be loud), and review Metabase's own audit logs for unauthorized user creation or setup-token abuse.
5. Apply segmentation. The Metabase host should reach only the specific database endpoints it needs. It should have no path to domain controllers, EHR application servers, or backup infrastructure.
6. Fix the process failure. The root lesson of Dorsata is governance: analytics platforms must be enrolled in vulnerability management SLAs. A CVSS 9–10 pre-auth RCE in an internet-facing service should be patched in days, not months. If your scanner doesn't know the instance exists, your SLA clock never starts.
7. Covered entities: audit your business associates. Ask every vendor handling your PHI, in writing, about their patch management program, external exposure management, and most recent penetration test. Dorsata's 58,000-patient notification event is what vendor risk failure looks like from the covered entity's side of the table.
The Bottom Line
Breaches caused by unpatched, known vulnerabilities are the most preventable category of incident — and the least defensible after the fact. Attackers do not need zero-days when defenders leave documented, exploited vulnerabilities on internet-facing infrastructure. For healthcare organizations and their technology partners, an analytics platform holding production database credentials is crown-jewel infrastructure and must be inventoried, patched, segmented, and monitored accordingly.
Security Arsenal's healthcare security practice helps covered entities and business associates build exactly this discipline: attack surface discovery, vulnerability management with real SLAs, and 24/7 detection engineering tuned to threats like this one.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.