Summary
- Environment: Photon’s Metabase environment
- Operational impact: No service-outage duration established
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 13, 2026; updated as evidence emerges.
What happened
Photon experienced unauthorized access from August 9–12, 2026. Blueberry’s combined notice says patient data was obtained in a separate compromise by a different actor from Blueberry’s own incident. [1]
Impact
The Photon exposure included contact details or membership identifiers and medication information. The notice does not quantify the affected population. [1]
Timeline
Suspicious email received
The email prompted Photon’s investigation.
[1]Vulnerability patched
Photon patched the Metabase vulnerability.
[1]Blueberry notified
Blueberry learned of its prescription provider’s separate incident.
[1]Briefing updated
This briefing was last reviewed and updated on October 13, 2026.
Threat Group & Attack Vector
The notice describes exploitation of the same Metabase vulnerability involved in Blueberry’s own compromise. It does not identify a CVE. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Photon’s patch followed the reported access window. The notice does not establish a precise intrusion method beyond vulnerability exploitation. [1]