For: people who received a notice letter from Photon Health or Blueberry Pediatrics, and anyone who runs a self-hosted analytics tool. This article is based on Photon Health's notice, the Oregon attorney general's breach list and Blueberry Pediatrics' sample consumer letter, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Total number of people affected at Photon Health
- How the incident relates to other organisations' notices
- Whether the company publishes more detail on the investigation
Photon Health published its notice on October 8, 2026 and has not said how many people are affected. Blueberry Pediatrics' count (340,915) comes from its report to the Oregon attorney general and is a separate company's figure.
What affected people should do today
Do not act on calls, texts or emails about a prescription, refund or insurance claim
The items combine your name, address, phone number and date of birth with medication information. That is enough for a caller to sound credible.
If someone contacts you about a "prescription problem", a "refund", a "pharmacy account" or an insurance claim, hang up and call back on a number you find yourself, such as the one on your insurance card or your pharmacy's website. See What is phishing? for the pattern.
Never give a Social Security number, card number or one-time code to someone who contacted you
Photon says Social Security numbers and financial information were not affected. A caller who asks for them anyway is not following any step Photon has described.
Use the credit monitoring offer only through your letter
Photon says it is offering complimentary credit monitoring and identity theft protection for 12 to 24 months. The enrollment steps are in the notification letter; the web notice does not repeat them. Do not enroll through a link in an unexpected email or text.
Check your insurer's statements for services you did not receive
If your health plan details were among the items (they are listed in Blueberry Pediatrics' letter, not in Photon's notice), read the explanation-of-benefits statements for charges you do not recognize and tell your insurer.
Ask the company only through the number in its notice
Photon's notice gives a phone line: 1-844-772-5746, 8:00 a.m. to 8:00 p.m. ET, Monday to Friday, excluding holidays. Use the contact details in the notice or letter, not ones given in a message you received.
What happened (from the notices)
Everything below is as stated in Photon Health's notice of October 8, 2026, unless another source is named.
Aug 21, 2026
Photon Health says it became aware of the incident.Sep 4
Photon says its review of the impacted data was completed.Oct 8
Photon published its notice and is notifying people whose information may have been involved.
- Who
- People whose information may have been involved; the number is not stated
- Items
- Name, address, phone number, date of birth, prescription medication information; varies by person
- Not affected
- Social Security numbers and financial information, which the company says it does not collect or store
- Cause (company's account)
- An unauthorized third party exploited a previously unknown vulnerability in the analytics tool (Metabase), which Photon runs on its own infrastructure for business intelligence, product metrics and customer dashboards
- Misuse
- No evidence of misuse or attempted misuse of the affected information
- Response
- Cybersecurity specialists engaged to investigate, contain and remediate; the company says its analytics-tool environment is secure and it is reviewing its technical safeguards
- Support
- 12 to 24 months of complimentary credit monitoring and identity theft protection; phone line 1-844-772-5746
A related disclosure: Blueberry Pediatrics (340,915 listed)
The Oregon attorney general's breach list shows a report from Blueberry Pediatrics dated October 10, 2026, showing 340,915 under “Number Affected” (the page says these are the figures at initial filing), a breach period of August 10 to August 22, 2026, a date of discovery of August 26 and notices sent on October 9. The list does not break out the Oregon count. The template notice gives August 22 as the discovery date, so the two sources differ. Blueberry's notices go to parents and guardians, because the patients are children.
Blueberry's sample consumer letter (filed with the California attorney general; the template uses the name Blueberry Medical) says a criminal exploited a vulnerability at Metabase, one of its technology providers, and stole a copy of some patient data. It lists name, health plan name and policy number, date of birth, and health care information such as medical records, dates of service, medical codes and charges for services. It says Social Security numbers and payment information were not included, and that photos and videos sent for diagnosis are stored separately and were not compromised.
This is a different company's count. Do not add it to Photon's, which has not been disclosed.
The California attorney general's breach list also has an entry for Photon Health giving August 10, 2026 as the breach date. That date differs from the August 21 date in Photon's notice, which is when the company says it became aware. This article uses the dates as each source states them.
What we know and do not know
As of October 31, 2026. This table will be rewritten when more is published.
| Item | What was announced | Status |
|---|---|---|
| Unauthorized access to a Photon analytics tool | Exploitation of a previously unknown vulnerability in the analytics tool | Confirmed (company) |
| Items involved | Name, address, phone number, date of birth, prescription medication information | Confirmed (company) |
| Social Security number, financial information | Not collected or stored by the company | Excluded (company) |
| Misuse of the data | No evidence of misuse or attempted misuse | No evidence (company) |
| People affected at Photon | Not stated in the notice | Not disclosed |
| Date the company became aware | August 21, 2026 (the California list shows a breach date of August 10) | Confirmed (company); dates differ by source |
| Blueberry Pediatrics people affected | 340,915 (Oregon attorney general list) | Confirmed (separate company) |
| Passwords, health plan details at Photon | Not listed in Photon's notice | Not stated |
| Connection between the Photon and Blueberry notices | Not mentioned in the two documents checked | Not stated |
What the combination of items can be used for
Names, addresses, phone numbers and dates of birth are available in many past breaches. What is unusual here is prescription medication information alongside them, which makes a scam call about a drug, a refill or an insurance claim sound real. This is what generally happens with this kind of data; it is not a statement that it has happened in this case.
Name + phone number + medication
↓→
Convincing calls about a refill or insurance claim
→ Hang up; call a number you look up
Name + address + date of birth
↓→
Fake letters, texts or emails using your details
→ Do not follow links; check on the official site
Not affected, per Photon
- Social Security number
- Financial information
May have been involved (varies by person)
- Name and address
- Phone number
- Date of birth
- Prescription medication information
How to read it: 'no evidence of misuse' is not 'safe from now on'
Photon says it has no evidence of misuse or attempted misuse. Dates of birth do not change, so the data can be used in messages months or years later. Treat contacts that use this incident as a reason to reach you with care.
For those who run analytics tools
Photon says the tool was one it runs itself, for reports and customer dashboards, and that a previously unknown vulnerability was exploited. This section covers only what the disclosed facts support. Details of the flaw are in this site's alert on CVE-2026-72898, and other organizations affected by the same product are in the article on the Metabase vulnerability breaches.
List the data your analytics tool can read
Such a tool is usually connected to production databases. What it can read is what can leak if it is compromised. In Photon's case, items such as medication information were reachable from a reporting tool. Check which tables and columns the tool actually needs for analysis, and cut the rest.
Know which of your tools are run by you and which by a vendor
Photon describes the tool as self-hosted, which means updates and exposure are the operator's job. Keep a list of the self-hosted tools you run and a way to hear about their security fixes (background: osv-scanner).
Plan for the time between the incident and the notice
By the company's account, about seven weeks passed between becoming aware (August 21) and the notice (October 8). Decide in advance who reviews affected data and who signs off on notices, so that review is not the bottleneck.
Sources (public record)
The facts in this article come from the public sources below. Undisclosed causes and counts are not speculated on.
- Photon Health, Notice of Data Security Incident (October 8, 2026) — PR Newswire
- California Attorney General, data breach report for Photon Health — oag.ca.gov
- Oregon Department of Justice, data breach notices list (Blueberry Pediatrics, reported October 10, 2026) — justice.oregon.gov
- Blueberry Pediatrics (Blueberry Medical), template consumer notice filed with the California attorney general — oag.ca.gov (PDF)
Update history
2026-10-31: First version, based on Photon Health's notice of October 8 and the regulator listings above. Photon has not disclosed a count; this article will be updated if it does.
Read next
- Same flaw, other organizations: Metabase vulnerability breaches (Trezor, Framework, n8n and others)
- Scam calls and messages: What is phishing? / Smartphone security basics
- Another US healthcare case: AdaptHealth data breach / US healthcare breaches in 2026
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)