{"id":"xsolis-patient-data-phishing-breach-jan-2026","category":"breach","status":"closed","title":"Xsolis phishing breach exposed patients’ identity and medical information; affected totals differ","tldr":"A phishing attack stole files from healthcare vendor Xsolis containing patients’ identity and medical details. Published totals differ: 1.40 million versus 2.52 million. Check your notice, ask about free monitoring and review credit and health-insurance statements.","summary":"A targeted phishing attack on 20 January 2026 let an intruder take files from Xsolis, which handles case and utilisation management for healthcare organisations. Depending on the person, the files may contain names, addresses, birth dates, Social Security numbers, health-insurance details and medical-treatment information. Xsolis says it contained the intrusion on 22 January; its June notice reported no subsequent unauthorised activity and no known actual or attempted misuse of the information. June reporting cited an HHS total of 1,396,519 affected people, while Indiana’s official register lists 2,523,302 overall. The sources reviewed do not explain that discrepancy. Xsolis issued notices and offered eligible recipients 12 months of Kroll identity protection, including services for children. Related federal lawsuits were consolidated on 15 July, and a filing index lists further state notices through 28 July. No settlement, criminal charges or confirmed recovery of the stolen files was identified in the material reviewed through 3 November.","action":"If you or a parent or child received a notice, check its enrolment deadline or call Xsolis’s published assistance line, +1 844 403 4585, about the free Kroll protection. Review credit reports, financial statements and health-insurance benefit statements for unfamiliar activity. If a Social Security number was involved, consider free credit freezes with Equifax, Experian and TransUnion.","product":"Xsolis healthcare case and utilisation management services","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["xsolis","healthcare","data-breach","phishing","identity-theft","patient-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Xsolis, Inc. Provides Notice of Data Security Incident","url":"https://www.prnewswire.com/news-releases/xsolis-inc-provides-notice-of-data-security-incident-302791875.html","by":"Xsolis","date":"2026-06-05"},{"kind":"advisory","title":"Website Notice of Data Security Incident","url":"https://www.xsolisdataincident.com/","by":"Xsolis","date":""},{"kind":"advisory","title":"Xsolis individual notification exemplars","url":"https://oag.ca.gov/system/files/Xsolis_CA_Individual%20Notification%20Exemplar%20(06.19.26)_0.pdf","by":"Xsolis, via California Attorney General","date":"2026-06-19"},{"kind":"advisory","title":"October 2026 year-to-date data breach report","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf","by":"Indiana Attorney General","date":""},{"kind":"news","title":"Healthtech firm Xolis suffers data breach impacting 1.4 million people","url":"https://www.bleepingcomputer.com/news/security/healthtech-firm-xolis-suffers-data-breach-impacting-14-million-people/","by":"BleepingComputer","date":"2026-06-23"},{"kind":"news","title":"US healthcare AI platform Xsolis confirms data breach that affects 1.4 million individuals","url":"https://www.techradar.com/pro/security/us-healthcare-ai-platform-xsolis-confirms-data-breach-that-affects-1-4-million-individuals","by":"TechRadar","date":"2026-06-23"},{"kind":"post","title":"Order consolidating Xsolis data breach litigation","url":"https://docs.justia.com/cases/federal/district-courts/tennessee/tnmdce/3:2026cv00839/109854/10","by":"US District Court for the Middle District of Tennessee, via Justia","date":"2026-07-15"},{"kind":"news","title":"Xsolis, Inc. data breach notices, Jun 5, 2026 to Jul 28, 2026","url":"https://www.acidpeak.com/notices/xsolis-inc-2026-06-05/","by":"AcidPeak","date":"2026-09-29"}],"started":"2026-01-20","closed":"2026-07-28","created":"2026-11-03T21:04:01.412Z","updated":"2026-11-03T21:04:01.412Z","cve_notes":[],"timeline":[{"at":"2026-07-28","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"AcidPeak’s filing index lists a further New Hampshire notice on 28 July, following notices in several other states. It also lists a 23 July Texas filing with the higher total of 2,523,302 people.","url":"https://www.acidpeak.com/notices/xsolis-inc-2026-06-05/","by":"AcidPeak","patch":null},{"at":"2026-07-15","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"A federal judge consolidated related lawsuits under “In re Xsolis, Inc. Data Breach Litigation” in Tennessee and appointed interim lead lawyers. Administrative closure of the individual cases transferred them into the combined proceedings; it did not resolve the claims.","url":"https://docs.justia.com/cases/federal/district-courts/tennessee/tnmdce/3:2026cv00839/109854/10","by":"US District Court for the Middle District of Tennessee, via Justia","patch":null},{"at":"2026-06-23","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"BleepingComputer and TechRadar reported 1,396,519 affected individuals, citing Xsolis’s HHS filing. BleepingComputer also reported mailed notifications and a 12-month Kroll identity-protection offer.","url":"https://www.bleepingcomputer.com/news/security/healthtech-firm-xolis-suffers-data-breach-impacting-14-million-people/","by":"BleepingComputer","patch":null},{"at":"2026-06-05","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Indiana’s subsequent year-to-date register records a 5 June notification for Xsolis, listing 2,523,302 people affected overall, including 2,920 Indiana residents. This differs from the HHS figure cited in June reporting.","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf","by":"Indiana Attorney General","patch":null},{"at":"2026-06-05","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Xsolis publicly disclosed the theft of files potentially containing patients’ identity, insurance and treatment information. It offered eligible notification recipients free identity monitoring and said it knew of no misuse or further unauthorised activity since 22 January.","url":"https://www.prnewswire.com/news-releases/xsolis-inc-provides-notice-of-data-security-incident-302791875.html","by":"Xsolis","patch":null},{"at":"2026-01-22","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Xsolis detected the intrusion, ended the unauthorised access and isolated affected computers and accounts. It brought in outside investigators and notified law enforcement.","url":"https://www.prnewswire.com/news-releases/xsolis-inc-provides-notice-of-data-security-incident-302791875.html","by":"Xsolis","patch":null},{"at":"2026-01-20","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"A targeted phishing attack gave an intruder access to part of Xsolis’s systems. Xsolis later confirmed that files were taken.","url":"https://www.xsolisdataincident.com/","by":"Xsolis","patch":"na"}],"url":"https://hard.fyi/live/xsolis-patient-data-phishing-breach-jan-2026/","json":"https://hard.fyi/api/live?id=xsolis-patient-data-phishing-breach-jan-2026"}