Xsolis phishing breach exposed patients’ identity and medical information; affected totals differ
A phishing attack stole files from healthcare vendor Xsolis containing patients’ identity and medical details. Published totals differ: 1.40 million versus 2.52 million. Check your notice, ask about free monitoring and review credit and health-insurance statements.
If you or a parent or child received a notice, check its enrolment deadline or call Xsolis’s published assistance line, +1 844 403 4585, about the free Kroll protection. Review credit reports, financial statements and health-insurance benefit statements for unfamiliar activity. If a Social Security number was involved, consider free credit freezes with Equifax, Experian and TransUnion.
What’s happening
A targeted phishing attack on 20 January 2026 let an intruder take files from Xsolis, which handles case and utilisation management for healthcare organisations. Depending on the person, the files may contain names, addresses, birth dates, Social Security numbers, health-insurance details and medical-treatment information. Xsolis says it contained the intrusion on 22 January; its June notice reported no subsequent unauthorised activity and no known actual or attempted misuse of the information. June reporting cited an HHS total of 1,396,519 affected people, while Indiana’s official register lists 2,523,302 overall. The sources reviewed do not explain that discrepancy. Xsolis issued notices and offered eligible recipients 12 months of Kroll identity protection, including services for children. Related federal lawsuits were consolidated on 15 July, and a filing index lists further state notices through 28 July. No settlement, criminal charges or confirmed recovery of the stolen files was identified in the material reviewed through 3 November.
- What
- Breach
- Affects
- Xsolis healthcare case and utilisation management services
- Fixed in
- Nothing to patch
- Since
- 20 Jan 2026
- Closed
- 28 July 2026
Timeline
- Update
AcidPeak’s filing index lists a further New Hampshire notice on 28 July, following notices in several other states. It also lists a 23 July Texas filing with the higher total of 2,523,302 people.
- Update
A federal judge consolidated related lawsuits under “In re Xsolis, Inc. Data Breach Litigation” in Tennessee and appointed interim lead lawyers. Administrative closure of the individual cases transferred them into the combined proceedings; it did not resolve the claims.
- Update
BleepingComputer and TechRadar reported 1,396,519 affected individuals, citing Xsolis’s HHS filing. BleepingComputer also reported mailed notifications and a 12-month Kroll identity-protection offer.
- Update
Indiana’s subsequent year-to-date register records a 5 June notification for Xsolis, listing 2,523,302 people affected overall, including 2,920 Indiana residents. This differs from the HHS figure cited in June reporting.
- Made public
Xsolis publicly disclosed the theft of files potentially containing patients’ identity, insurance and treatment information. It offered eligible notification recipients free identity monitoring and said it knew of no misuse or further unauthorised activity since 22 January.
- Update
Xsolis detected the intrusion, ended the unauthorised access and isolated affected computers and accounts. It brought in outside investigators and notified law enforcement.
- UpdateNothing to patch
A targeted phishing attack gave an intruder access to part of Xsolis’s systems. Xsolis later confirmed that files were taken.
Sources
- Xsolis, Inc. Provides Notice of Data Security IncidentXsolis · 5 June 2026
- Website Notice of Data Security IncidentXsolis
- Xsolis individual notification exemplarsXsolis, via California Attorney General · 19 June 2026
- October 2026 year-to-date data breach reportIndiana Attorney General
- Healthtech firm Xolis suffers data breach impacting 1.4 million peopleBleepingComputer · 23 June 2026
- US healthcare AI platform Xsolis confirms data breach that affects 1.4 million individualsTechRadar · 23 June 2026
- Order consolidating Xsolis data breach litigationUS District Court for the Middle District of Tennessee, via Justia · 15 July 2026
- Xsolis, Inc. data breach notices, Jun 5, 2026 to Jul 28, 2026AcidPeak · 29 Sept 2026