Photon Health, Inc. Data Breach

DireWolf ransomware group claimed to target Photon Health, Inc., a telehealth and digital health provider based in the United States. The listing appeared on the group’s dark web portal on August 19, 2026, and was identified by SOCRadar’s Dark Web Monitoring. As a healthcare provider, Photon Health operates under stringent HIPAA regulations that mandate breach reporting to the Department of Health and Human Services (HHS) within 60 days of discovery, alongside direct notification to affected patients when feasible. The sensitive nature of patient identity and appointment data, classified as protected health information (PHI), means that any exposure through any access vector triggers these significant obligations. This August 19th announcement from DireWolf included four victims: Photon Health and InfoFlo CRM (both US healthcare organizations), Lifesum (Sweden, Healthcare Technology), and PayUp (Financial Services). This batch of four victims in a single day, with three from the health sector, reinforces DireWolf’s consistent focus on healthcare organizations throughout its recent campaign activity. This incident aligns with the group’s established targeting patterns, further emphasizing the risks faced by entities within the healthcare ecosystem.

DireWolf listed Photon Health, Inc. on its dark web portal on August 19, 2026, as identified by SOCRadar’s Dark Web Monitoring. A query against the domain photonhealth[.]com for stealer-log records returned no results. However, this absence of direct correlation does not confirm that the organization is unaffected. The query was paginated and bounded, meaning credentials may exist under a related corporate domain or personal email alias not included in the sampled data. Furthermore, Photon Health’s telehealth API surface and patient portal infrastructure represent potential exposure vectors that fall outside the scope of this specific dataset. The implications of exposed credentials for ransomware operations are significant. Even if no direct stealer-log records were found for photonhealth[.]com, the possibility remains that compromised credentials from other sources could grant access to the organization’s network. Such access could pave the way for ransomware deployment, especially given the sensitive nature of the data handled by healthcare providers. The HIPAA compliance clock further adds urgency, as any breach of PHI necessitates specific reporting and notification procedures. Given the DireWolf listing and the potential for credential exposure through various avenues, continued dark web monitoring and proactive security measures are recommended. This includes credential hygiene checks, regular password rotation, multi-factor authentication review, and monitoring of alternate corporate domains, as well as VPN and remote access activity logs.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.