Data breaches have been announced by the New York-based healthcare technology company Photon Health, the Texas-based medical provider network company Healthcare Highways, and the New York-based home health agency Any-Time Home Care. Photon Health Photon Health, a Brooklyn, New York-based healthcare technology company that operates a prescription network, has disclosed a cybersecurity incident involving unauthorized access to patient data.
Photon Health learned on August 21, 2026, that a previously unknown security flaw in a self-hosted third-party application called Metabase had been exploited. Metabase was used by Photon Health for business intelligence, product metrics, and customer dashboards. The threat actor exploited the zero-day vulnerability and gained access to stored data, which was potentially exfiltrated.
Photon Health completed its data review on September 4, 2026, when it was confirmed that data compromised in the incident included names, addresses, phone numbers, birth dates, and prescription information. Notification letters started to be mailed to the affected individuals on October 8, 2026. At the time of issuing notification letters, Photon Health was unaware of any misuse of the impacted data.
The Direwolf ransomware and data extortion group claimed responsibility for the attack. The company has not yet publicly disclosed how many of its clients have been affected or the total number of individuals who had their data exposed in the incident, but has confirmed that complimentary credit monitoring and identity theft protection services have been offered to the affected individuals.
Photon Health also confirmed that it is reviewing its cybersecurity measures and is taking steps to prevent similar incidents in the future. Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Healthcare Highways Healthcare Highways, a Frisco, Texas-based medical provider network company and health plan administrator, has recently disclosed a cybersecurity incident that was first identified on August 4, 2026.
An investigation was launched to determine the nature and scope of the activity, which confirmed that an unauthorized third party had access to its network between July 22, 2026, and July 27, 2026. During that time, the protected health information of certain individuals was accessed and acquired. The review of the affected data is ongoing; however, it has been determined that the types of data compromised in the incident include names, addresses, dates of birth, dates of service, Social Security numbers, patient ID numbers, procedure codes and costs, procedure/provider information, diagnoses, claims information, health insurance information, and information related to payment for healthcare services.
Healthcare Highways has yet to publicly disclose the total number of individuals affected by the incident. While the group behind the attack was not disclosed, the Chaos ransomware group claimed responsibility and says it exfiltrated 235 GB of data. Any-Time Home Care The New York-based home health agency Any-Time Home Care has recently disclosed a ransomware attack that was identified in March 2026.
The forensic investigation determined that an unauthorized third party first accessed its network on or around March 17, 2026, and encrypted files. Files on the compromised parts of its network have been reviewed and found to contain names, addresses, birth dates, health information, and Social Security numbers. In total, 30,017 individuals have been affected by the incident.
The affected individuals have been offered 24 months of complimentary credit monitoring and identity theft protection services. The post Photon Health; Healthcare Highways Announce Data Security Incidents appeared first on The HIPAA Journal .
Originally published at hipaajournal.com
