Almeida Law Group is investigating a data breach at Photon Health. The breach occurred on August 9th–10th, 2026 and was discovered on August 21st, 2026. If you were affected, contact Almeida Law Group.
About Photon Health
Photon Health is a healthcare technology company that operates a digital prescription network. Founded in 2021 and headquartered in New York, New York, the company simplifies prescribing workflows and manages pharmacy fulfillment for digital health organizations, enabling patients to compare pharmacies by price, convenience, and availability. The company has routed over one million prescriptions and is privately held with venture capital backing. Because Photon Health handles prescription medication information, names, addresses, and dates of birth, a breach of its systems carries meaningful risks for affected individuals.
What Happened?
Photon Health was listed in a Texas Attorney General data security breach report (record BR-0005440). The incident involved unauthorized access to systems containing names, addresses, dates of birth, and prescription medication information. A total of 3,085 people were affected. Photon Health notified consumers by U.S. mail beginning on October 8th, 2026. The company confirmed that Social Security numbers and financial information were not impacted, as it does not collect or store that data.
According to Photon Health’s own disclosure, published via PR Newswire on October 8th, 2026, an unauthorized third party exploited a previously unknown zero-day vulnerability in Metabase, a self-hosted third-party business intelligence application. The company learned of the intrusion on August 21st, 2026 and completed its data review on September 4th, 2026. The Direwolf ransomware and data extortion group separately claimed responsibility for the attack. On August 19th, 2026—two days before Photon Health discovered the breach—Direwolf posted a claim on a dark web leak site alleging it had obtained 63.3 GB of data and threatening to publish it. This is an attacker-side allegation and has not been confirmed by Photon Health. At least two federal lawsuits have been filed in the U.S. District Court for the Southern District of New York: Horne v. Photon Health, Inc. (Case No. 1:2026cv07337, filed August 28th, 2026) and Marshall v. Photon Health, Inc. (Case No. 1:2026cv07512, filed September 2nd, 2026). No prior breaches involving Photon Health were found in available sources.
Key Facts at a Glance
- Company or Organization: Photon Health
- Industry: Healthcare Technology / Digital Health; Prescription Network and Pharmacy Fulfillment
- Location: New York, New York
- Incident type: Unauthorized access via zero-day vulnerability in Metabase (third-party business intelligence application)
- Date of breach: August 9th, 2026 – August 10th, 2026
- Date breach discovered: August 21st, 2026
- Date of consumer notification: October 8th, 2026
- Total persons affected: 3,085
- Litigation status: At least two federal lawsuits filed in S.D.N.Y.: Horne v. Photon Health, Inc. (filed August 28th, 2026) and Marshall v. Photon Health, Inc. (filed September 2nd, 2026); multiple class action investigations announced by law firms
- Source: Texas Attorney General data security breach report; Photon Health official notice (PR Newswire); HIPAA Journal; BeyondMachines; teiss; Horne v. Photon Health (Justia); Marshall v. Photon Health (Justia)
What Should You Do?
If you received a notice from Photon Health, review it carefully for enrollment instructions regarding any identity protection services offered. Because prescription medication information and personal identifiers were exposed, review your Explanation of Benefits statements and any medical records for services you do not recognize. Place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—and monitor your credit reports for unfamiliar accounts or inquiries. You can request free annual credit reports at AnnualCreditReport.com. If you suspect your information has been misused, visit IdentityTheft.gov for step-by-step guidance on reporting and recovery.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
