Phishing breach at healthtech firm Xsolis exposes 1.4 million people

On 23 June 2026, Xsolis — a US-based healthcare technology company whose AI-driven software is used by hospitals and health insurers for utilization management, medical-necessity review and revenue-cycle decisions — disclosed a data breach affecting nearly 1.4 million people. As a HIPAA business associate that handles data on behalf of more than 600 health organizations, the breach makes Xsolis one of the larger business-associate incidents reported so far in 2026.

What happened

According to Xsolis, the incident stemmed from a targeted phishing attack that began on 20 January 2026 and gave an unauthorized actor access to a limited portion of its environment. The company said it detected the activity on 22 January 2026, interrupted and contained it, ended the unauthorized access, and isolated the affected hosts and user accounts before bringing in outside cybersecurity experts.

The breach was added to the US Department of Health and Human Services breach portal, where the number of affected individuals was listed as 1,396,519. No ransomware was reported deployed, and no threat actor had publicly claimed responsibility at the time of disclosure.

Impact

Xsolis said the attacker accessed files containing personal and protected health information that the company had received from its clients. The exposed data included names, dates of birth, addresses, Social Security numbers, health-insurance information and medical-treatment information. The company stated it was not aware of any actual or attempted misuse of the information as of its notice and said it was notifying affected individuals.

Why it matters

The breach is another reminder that a single successful phishing email against a healthcare vendor can expose the sensitive records of well over a million patients who never directly interacted with that company. Business associates sit on large pools of protected health information aggregated from many providers, making them attractive targets and amplifying the blast radius of even a contained intrusion. Durable identifiers such as Social Security numbers and medical histories cannot simply be reset, leaving affected patients exposed to fraud and identity theft long after remediation.