Investigating

Photon Health reports possible data acquisition via Metabase zero-day

A zero-day in self-hosted Metabase was exploited and data may have been acquired on August 9–10, 2026.

Last updated: 2026-11-09

Overview

Learned August 21; the company does not store SSNs or financial data. No total is given.

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

California AG data breach report: Photon HealthCalifornia Department of Justice, Office of the Attorney General · 2026-11-09
Sample consumer notice filed with California AG (Photon Health)California Department of Justice, Office of the Attorney General · 2026-11-09