Photon Health Data Breach: PHI and PII Exposed

Photon Health, a Brooklyn-based healthcare technology company that builds digital prescribing tools for patients, clinicians and pharmacies, disclosed a data breach that exposed personal and health-related information.

On Aug. 19, 2026, a ransomware group known as Dire Wolf posted a claim on the dark web using the Tor network. The group stated that it had obtained 63.3 gigabytes of data from Photon Health and threatened to publish the stolen information within 12 to 13 days.

Two days after the dark web posting appeared, on Aug. 21, 2026, Photon Health discovered that an unauthorized third party had exploited a previously unknown security flaw in a tool called Metabase.

Metabase is a third-party application that Photon Health used on a self-hosted basis for business intelligence, product metrics and customer dashboards. The attacker took advantage of this vulnerability to gain access to certain data stored within the company's systems.

An investigation into the incident confirmed that certain data may have been acquired by the unauthorized party. On Sept. 4, 2026, Photon Health completed its review of the affected data and determined that personal information may have been impacted.

The types of personally identifiable information exposed included names, addresses, phone numbers, dates of birth and prescription medication information. According to the company's notification, Social Security numbers and financial information were not impacted in this incident.

Photon Health published a notice of the data security incident on Oct. 8, 2026, and began notifying potentially affected individuals.

Photon Health's response to the breach

After discovering the breach, Photon Health took immediate steps to secure the affected Metabase application and engaged a team of outside cybersecurity experts to investigate, contain and remediate the incident. The company implemented enhanced security measures, and its security team has been working with cybersecurity specialists to confirm the security of its Metabase environment, according to the notification.

The company stated that it is "continually reviewing and revising technical safeguards and making enhancements to reduce the likelihood of a similar event in the future."

Photon Health began sending notification letters to potentially impacted individuals. These letters include steps that recipients can take to help protect their information. To further assist those who may have been affected, the company is offering complimentary credit monitoring services for a period of 24 months at no cost. Photon Health recommends that individuals enroll in the services provided and follow the recommendations contained in their notification letter.

Individuals who have questions about the incident or need more information can contact Photon Health's dedicated call center at 1-844-772-5746. The call center is available from 8 a.m. to 8 p.m. ET, Monday through Friday, excluding holidays.