Breaches and incidents
Photon Health (Brooklyn, New York): Metabase zero-day exposes prescription data, Direwolf claims attack
Photon’s letter dated 8 Oct 2026 (filed with the California AG) says it learned on 21 Aug 2026 that an unauthorized party “exploited a previously unknown...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Photon’s letter dated 8 Oct 2026 (filed with the California AG) says it learned on 21 Aug 2026 that an unauthorized party “exploited a previously unknown security flaw (sometimes called a ‘zero-day’ vulnerability) in Metabase”, which it self-hosts for BI and dashboards, and data may have been acquired between 9 and 10 Aug 2026; HIPAA Journal lists names, addresses, phone numbers, birth dates and prescription information. Blueberry Pediatrics’ notice gives the Photon access window as 9 to 12 Aug 2026, so the sources differ.
- Root cause: Metabase zero-day in a self-hosted instance.
- HIPAA Journal says the Direwolf ransomware and data extortion group claimed responsibility; Photon does not name a group.
- Photon secured the application, engaged experts, completed its data review on 4 Sep 2026 and offered credit monitoring. The count is not disclosed.