---
title: "Photon Metabase prescription-data incident"
description: "Photon patient data was obtained through a Metabase vulnerability in August 2026, according to Blueberry’s notice."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-13"
canonical_url: "https://www.ally.security/incidents/photon-metabase-prescription-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/photon-metabase-prescription-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/photon-metabase-prescription-data-incident-2026/stix.json"
---

# Photon Metabase prescription-data incident

Blueberry disclosed a separate compromise at its prescription provider Photon, involving another criminal actor.

Last modified Oct 13, 2026 · 1 source

## Summary

- **Environment:** Photon’s Metabase environment
- **Operational impact:** No service-outage duration established
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Photon](https://photonhealth.com/) experienced unauthorized access from August 9–12, 2026. [Blueberry’s combined notice](https://oag.ca.gov/system/files/Blueberry%20Template%20Consumer%20Notices%20Re%20Photon.pdf) says patient data was obtained in a separate compromise by a different actor from Blueberry’s own incident. [1](#source-1)

## Impact

The Photon exposure included contact details or membership identifiers and medication information. The notice does not quantify the affected population. [1](#source-1)

## Timeline

### August 19, 2026 — Suspicious email received

The email prompted Photon’s investigation. [1](#source-1)

### August 21, 2026 — Vulnerability patched

Photon patched the Metabase vulnerability. [1](#source-1)

### August 24, 2026 — Blueberry notified

Blueberry learned of its prescription provider’s separate incident. [1](#source-1)

### October 13, 2026 — Briefing updated

This briefing was last reviewed and updated on October 13, 2026.

## Threat Group & Attack Vector

The notice describes exploitation of the same [Metabase](https://www.metabase.com/) vulnerability involved in [Blueberry’s own compromise](/incidents/blueberry-pediatrics-metabase-data-incident-2026). It does not identify a CVE. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Photon’s patch followed the reported access window. The notice does not establish a precise intrusion method beyond vulnerability exploitation. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/photon-metabase-prescription-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Blueberry consumer notice — separate Photon incident

official · Blueberry Pediatrics

<https://oag.ca.gov/system/files/Blueberry%20Template%20Consumer%20Notices%20Re%20Photon.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Photon Metabase prescription-data breach: Blueberry reported a separate Photon Metabase compromise by a different criminal actor from the one involved in Blueberry’s own incident.
2. **Affected Organization · 100% confidence · current**  
   Photon Metabase prescription-data breach: Blueberry Pediatrics
3. **Resulted In · 100% confidence · current**  
   Blueberry learns of Photon incident: Blueberry learned of the separate incident at its prescription provider.
4. **Resulted In · 100% confidence · current**  
   Photon patches vulnerability: Photon patched the Metabase vulnerability.
5. **Resulted In · 100% confidence · current**  
   Photon Metabase prescription-data breach: Photon patches vulnerability
6. **Occurred At · 100% confidence · current**  
   Photon patches vulnerability: 2026-08-21
7. **Vendor Of · 100% confidence · current**  
   Photon: Blueberry Pediatrics
8. **Affected Organization · 100% confidence · current**  
   Photon Metabase prescription-data breach: Photon
9. **Resulted In · 100% confidence · current**  
   Photon receives suspicious email: Photon received an email that prompted its investigation.
10. **Used Product · 100% confidence · current**  
   Photon Metabase prescription-data breach: Metabase
11. **Began At · 100% confidence · current**  
   Photon Metabase prescription-data breach: 2026-08-09
12. **Occurred At · 100% confidence · current**  
   Photon receives suspicious email: 2026-08-19
13. **Resulted In · 100% confidence · current**  
   Photon Metabase prescription-data breach: Photon determined that an unauthorized party obtained patient data; Blueberry described affected information as contact details, membership identifiers and medication information.
14. **Ended At · 100% confidence · current**  
   Photon Metabase prescription-data breach: 2026-08-12
15. **Resulted In · 100% confidence · current**  
   Photon Metabase prescription-data breach: Blueberry learns of Photon incident
16. **Resulted In · 100% confidence · current**  
   Photon Metabase prescription-data breach: Photon receives suspicious email
17. **Occurred At · 100% confidence · current**  
   Blueberry learns of Photon incident: 2026-08-24

</details>