Three US healthcare entities disclosed data breaches via the HIPAA Journal on 13 October. Photon Health (Brooklyn-based prescription network) confirmed a threat actor exploited a previously unknown zero-day in its self-hosted Metabase business-intelligence instance (learned 21 August), gaining access it said could have been exfiltrated; exposed data includes names, addresses, phone numbers, birth dates and prescription information, with notification letters mailed from 8 October. The Direwolf ransomware-and-extortion group claimed responsibility. Healthcare Highways (Frisco-based medical provider network and health plan administrator) confirmed unauthorised network access between 22–27 July; exposed data includes Social Security numbers, patient IDs, diagnoses, claims and payment information, with Chaos ransomware claiming responsibility and saying it exfiltrated 235 GB. Any-Time Home Care (New York home health agency) confirmed a ransomware attack traced to around 17 March that ultimately affected 30,017 individuals, including names, health information and Social Security numbers, with 24 months of credit monitoring offered. All three have confirmed breach status via notification or incident disclosure; affected-individual counts remain partially undisclosed pending OCR portal publication.

• Source article