Three healthcare organisations disclosed intrusions this week, including a prescription technology platform hit through a flaw in a self-hosted tool.
Photon Health, a Brooklyn-based company that runs a prescription network, learned on August 21 that an unknown vulnerability in Metabase, a business intelligence application it self-hosted, had been exploited. The attacker reached stored data that was potentially exfiltrated. Photon finished its review on September 4 and confirmed that names, addresses, phone numbers, birth dates and prescription information were involved, with notices mailed from October 8. The Direwolf extortion group claimed responsibility.
In Texas, Healthcare Highways, a Frisco-based provider network and health plan administrator, said an intruder was inside its network from July 22 to July 27. The compromised data includes names, addresses, dates of birth, dates of service, Social Security numbers and patient identifiers. Any-Time Home Care, a New York home health agency, also reported an incident.
The Photon case is the clearest lesson. Metabase is widely self-hosted by health technology teams, and an unpatched instance became the entry point. Any healthcare organisation running self-hosted analytics, dashboards or business intelligence tools should inventory those deployments, confirm they are patched and exposed only where necessary, and check whether they hold PHI at all.
Self-hosted tooling often grows quietly outside a security team’s view. In this case, a single overlooked application carried prescription data for an entire network.
