2026 Photon Health — unauthorised access exposed patient names, contact details and prescription data; 30,625 people reported to HHS
Data compromised
Names, addresses, phone numbers, dates of birth and prescription information, per HIPAA Journal's summary. HHS OCR lists 30,625 individuals.
Technical writeup
The PR Newswire notice was read through search excerpts; the page returned an error to our tools. The Metabase link comes from secondary coverage. The posting date is the October 8 notice; the California AG posting is October 28.
Root cause
Photon Health's notice, published October 8, 2026, describes unauthorised access to its systems. Coverage links the access to a flaw in the Metabase business-intelligence tool. A group calling itself DireWolf has claimed the attack; that claim is unverified.