Photon Health

A zero-day in Metabase, the self-hosted analytics tool Photon Health ran for business metrics and customer dashboards, exposed stored names, addresses, birth dates, phone numbers, and prescription details, potentially exfiltrated. Photon learned of it on August 21, 2026; when the intrusion began, and how many people it reached aren't shared. The Direwolf extortion group claims credit. The perimeter was a reporting tool that had silently become a copy of the prescription record.