Three US healthcare organisations have disclosed separate breaches of patient data. Photon Health is a Brooklyn, New York company that runs a prescription network. Healthcare Highways is a provider network and health plan administrator in Frisco, Texas. Any-Time Home Care is a home health agency in New York. Photon's breach is the best documented. In its own notice, distributed via PRNewswire on October 8, 2026, the company confirmed that an unauthorized third party exploited a previously unknown (zero-day) flaw in its self-hosted Metabase business intelligence application. Names, addresses, phone numbers, dates of birth and prescription medication information may have been taken. Photon has not said how many individuals or client organisations were affected. HIPAA Journal and MedRisk report that the Direwolf (also written "Dire Wolf") ransomware and extortion group claimed responsibility. teiss reports that the group says it took 63.3 GB of Photon data.
What Happened
Photon Health. According to Photon's own notice, the company learned on August 21, 2026 that an attacker had exploited a zero-day vulnerability in Metabase. Photon hosts Metabase itself and uses it for business intelligence, product metrics and customer dashboards. Photon says it secured the application, brought in outside cybersecurity specialists, and found that "certain data may have been acquired without authorization." It finished reviewing the affected data on September 4, 2026 and began mailing notification letters on October 8, 2026. Photon says it has "no evidence of misuse, or attempted misuse" of the data.
The extortion timeline matters. teiss reports that Dire Wolf posted a claim on its Tor leak site on August 19, 2026, two days before Photon says it found the intrusion. The group threatened to publish the data within 12 to 13 days. If that date is accurate, Photon may have learned of the breach from the extortion claim rather than from its own detection. The company has not confirmed this. One source disagrees on attribution: ColibriSec calls the actor "unidentified." HIPAA Journal, the highest-weighted source here, names Direwolf.
Healthcare Highways. HIPAA Journal reports that the company identified a cybersecurity incident on August 4, 2026. MedRisk reports that an intruder had access to the network from July 22 to July 27, 2026. We have not seen a primary notice confirming that window.
Any-Time Home Care. HIPAA Journal and MedRisk both report that this New York home health agency disclosed a breach. Neither source gives details on the cause, the timeline or the data involved.
What Was Taken
Photon Health: Photon's notice lists name, address, phone number, date of birth and prescription medication information. It says the data exposed "were different for each individual." Photon states that Social Security numbers and financial information were not affected because it does not collect or store them. No headcount has been published by Photon, by HIPAA Journal or by any regulator filing among these sources. DataBreachRights lists the number of people affected as "Not Publicly Disclosed." The only figure for the size of the theft is Dire Wolf's own claim of 63.3 GB, reported by teiss. It has not been independently verified.
Prescription data is sensitive even without Social Security numbers. A list of medications can reveal conditions such as HIV, mental health treatment, addiction treatment or reproductive care. That makes it useful for targeted phishing and for extortion of individuals.
Healthcare Highways: MedRisk reports that the compromised data includes names, addresses, dates of birth, dates of service, Social Security numbers and patient identifiers. If confirmed, the exposure of Social Security numbers makes this the higher identity-theft risk of the three breaches. The number of people affected has not been disclosed in these sources.
Any-Time Home Care: No details on the data or the number of people affected are available in these sources.
Remediation: Photon is offering free credit monitoring and identity theft protection. TechJournal reports the coverage runs 12 to 24 months.
Why It Matters
Photon's breach did not start in a core clinical system. It started in an analytics tool. Metabase was deployed for dashboards and product metrics, yet it held, or could query, prescription data for patients across Photon's network. This is a familiar pattern: business intelligence and observability tools are given broad read access to production data, and security teams rarely govern them as closely as the systems of record.
Sources disagree on one point that matters for defenders. MedRisk calls the entry point an "unpatched instance." Photon's own notice, along with HIPAA Journal and teiss, describes a previously unknown zero-day. If Photon's account is correct, patching could not have prevented the initial exploit. The defences that would have reduced the damage are limits on network exposure, least-privilege database connections, and monitoring for unusual queries from the BI layer.
The gap between Dire Wolf's reported August 19 claim and Photon's August 21 discovery date also shows how often healthcare victims learn of a breach from the attacker, not from their own monitoring.
The Attack Technique
All sources agree on the basics: a zero-day in a self-hosted Metabase deployment gave the attacker access to stored data, and the data was potentially exfiltrated. Photon has not published technical details or a CVE.
ColibriSec, an OTHER-tier source, gives a much more specific account. It describes an unauthenticated SQL injection in Metabase's password-reset workflow, tracked as CVE-2026-72898. According to ColibriSec, the attacker used it to extract administrator credentials and session cookies, then used Metabase's built-in database connectors to query internal replica databases holding prescription transaction data. ColibriSec says this detail comes from filings with state attorneys general. None of the other sources, including Photon's own notice, mentions a CVE, SQL injection or the password-reset vector. Treat this account as unverified until Metabase or Photon confirms it.
No technique has been reported for the Healthcare Highways or Any-Time Home Care breaches.
What Organizations Should Do
- Inventory self-hosted analytics and dashboard tools. Find every Metabase, Superset, Redash, Grafana and similar instance. Check whether it is internet-facing, who owns it, and whether it can reach PHI.
- Take BI tools off the public internet. Put them behind SSO, a VPN or a zero-trust access proxy. An exploit that needs no login is far less dangerous when the login page can't be reached from the internet.
- Restrict data-source connections. BI tools should use read-only service accounts limited to de-identified or aggregated views wherever possible, not full production or replica databases holding prescription records.
- Monitor the BI layer for unusual activity. Alert on new admin sessions, new database connections, large query results and bulk exports from analytics hosts.
- Track vendor advisories and threat-actor leak sites. Subscribe to Metabase security releases and patch quickly. Monitor extortion leak sites so a claim like Dire Wolf's reaches you before you hear about it from a reporter.
- Prepare patient-facing defences. Affected patients should expect phishing that references their prescriptions. Brief call centres and pharmacy partners, and tell patients how you will and won't contact them.
Sources: Healthcare Highways Announce Data Security Incidents | Notice of Data Security Incident | Photon Health Metabase Breach: What Patients Should Do | Notice of Data Security Incident - Nativo Ventures | Photon Health Data Breach Exposes Patient Data | teiss - News - Photon Health discloses breach of prescription data... | Photon Health Data Breach: Zero-Day SQL Injection in Self-Hosted Me... | Prescription network and provider group join the breach rolls – Med...