Short answer
Photon Health, a Brooklyn-based company whose software helps providers manage prescriptions, says an unauthorized party exploited a previously unknown flaw in Metabase, a self-hosted analytics tool, and may have taken data on 9 and 10 August 2026. Photon learned of it on 21 August and began mailing letters on 8 October. HIPAA Journal reports 30,625 people affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Photon Health |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare technology (prescription software) |
| Country | United States |
| Detected | 2026-08-21 |
| Disclosed | 2026-10-08 |
| People or records affected | 30,625 individuals, as reported to the HHS Office for Civil Rights (per HIPAA Journal) |
What data was exposed
- Phone number and text messages sent (as stated in Photon's letter)
- Names, addresses, birth dates and prescription information (as reported by HIPAA Journal)
- Photon says Social Security numbers and financial information were not involved, because it does not collect or store them
What happened
Photon Health provides software that healthcare providers use to manage prescriptions and other aspects of patient care. In a sample notice posted by the California Attorney General, dated 8 October 2026, Photon says it learned on 21 August that an unauthorized party had exploited a previously unknown security flaw, often called a zero-day, in Metabase. Metabase is a third-party tool Photon runs on its own servers for business intelligence, product metrics and customer dashboards.
The investigation found that certain data may have been acquired without authorization on 9 and 10 August 2026. Photon says it secured the application, hired cybersecurity specialists, and finished its review of the affected data on 4 September. It says it has no evidence of misuse or attempted misuse.
What data was involved
The letter says the information involved includes phone numbers and text messages sent. It also states that Social Security numbers and financial information were not affected, because Photon does not collect or store them. HIPAA Journal, reporting on 13 October, describes the data as names, addresses, phone numbers, birth dates and prescription information. We have shown both descriptions because the sources word it differently, and the exact fields can vary by person.
HIPAA Journal also reports that Photon told the HHS Office for Civil Rights that 30,625 people were affected, and that the Direwolf ransomware and data extortion group claimed responsibility. Treat the attacker’s identity as a claim. Photon’s own letter does not name one.
What Photon is offering
Photon is providing 12 months of single-bureau credit monitoring, a credit report and a credit score through Cyberscout, a TransUnion company, along with fraud assistance. Recipients must enroll within 90 days of the letter date. The help line is 1-844-772-5746 (Monday to Friday, 8 a.m. to 8 p.m. Eastern).
What is still unknown
- whether the data has been published or sold;
- which providers’ patients make up the 30,625 total;
- why the two descriptions of the exposed fields differ.
Staying safe
Prescription details make a scam call or text sound credible. A caller who knows your medication is not proof they work for your pharmacy or insurer. Our guide to phishing messages shows how to check a sender, vishing and callback phone scams covers phone pressure tactics, and what to do after a data breach covers freezes and monitoring.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts or calls that mention a real prescription, pharmacy or prescriber to sound legitimate
- Fake 'Photon Health' or pharmacy messages offering free credit monitoring through a link you did not ask for
- Callers posing as your insurer or pharmacy who ask you to confirm identity details or pay a 'balance' on a prescription
- Extortion-style messages that reference the attacker's claim and demand payment to stop publication
What to do if you are affected
- 01Read your letter from Photon (it is sent from Cyberscout, a TransUnion company) and keep the enrollment code. The offer is 12 months of single-bureau credit monitoring, and you must enroll within 90 days of the letter date.
- 02Enroll only through the address printed in the letter, not through a link in a text or email you did not expect.
- 03Check explanation-of-benefits statements and pharmacy records for prescriptions you do not recognize, and report them to your insurer or provider.
- 04Treat any unsolicited call, text or email that mentions your prescriptions as unverified. Photon says it will not ask for your Social Security number, payment details or login credentials.
- 05If you want extra protection, place a free credit freeze with each of the three credit bureaus. Questions can go to the help line in the letter, 1-844-772-5746.
Frequently asked questions
What is Photon Health?
A technology company whose software healthcare providers use to manage prescriptions and other parts of patient care. You get a letter because a provider involved in your care uses the platform, not because you signed up with Photon.
How did the attackers get in?
According to Photon's letter, an unauthorized third party exploited a previously unknown flaw (a zero-day) in Metabase, a third-party business intelligence tool Photon runs on its own infrastructure. Photon says it secured the application after learning of the problem on 21 August 2026.
Were Social Security numbers taken?
Photon's letter says no. It states that Social Security numbers and financial information were not involved because the company does not collect or store them.
Has anyone claimed responsibility?
HIPAA Journal reports that the Direwolf ransomware and data extortion group claimed the attack. That is the group's claim, and Photon's letter does not name an attacker.
Is the data being misused?
Photon says it has no evidence of misuse or attempted misuse. Because the information includes prescription details and phone numbers, expect targeted calls and texts and treat them with caution.
Sources
- Photon Health notice of data breach (sample letter dated 8 October 2026), California Attorney General (organization notice), 2026-10-08
- Photon Health; Healthcare Highways Announce Data Security Incidents, HIPAA Journal, 2026-10-13
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.