Xsolis

Disclosed Jun 5, 20262,523,302 affectedConfirmed

Xsolis phishing breach exposes health data of 1,396,519 people

Healthcare AI company Xsolis reported to HHS that a January 2026 phishing attack gave attackers network access, exposing names, SSNs, insurance and treatment data of 1,396,519 people.

What is known

People affected	2,523,302 (as reported by the organization)
Disclosed	Jun 5, 2026
Discovered	Jan 22, 2026
Happened	Jan 20, 2026
Attack	Phishing
Data exposed	NamesHealthAddressesDates of birthSocial Security numbersInsurance
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Xsolis

Official noticeatg.wa.gov

Washington Attorney General breach notice: Xsolis

Official noticeocrportal.hhs.gov

HHS OCR breach report: Xsolis (Business Associate, TN)

Newsbleepingcomputer.com

Healthtech firm Xsolis suffers data breach impacting 1.4 million people

Official noticexsolisdataincident.com

Xsolis data incident

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005192: Xsolis

Official noticein.gov

Indiana Attorney General 2026 data breach report: Xsolis

Notices filed

TotalJun 5

HHS OCR1,396,519 people

Residents of INJun 5

Indiana AG154 people

Residents of CAJun 19

California AGCount not stated

Residents of WAJun 19

Washington AG26,203 people

TotalJun 23

Research1,396,519 people

Residents of CAJul 21

California AGCount not stated

Residents of TXJul 23

Texas AG139,424 people

History of this record

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdfby backfillSource

records_basis2026-09-25

hhs to organizationby backfillSource

records2026-09-25

1396519 to 2523302by backfillSource

attack2026-09-25

hacking to phishingby seedSource

data_types2026-09-25

["names","health"] to ["names","health","addresses","dob","ssn","insurance"]by seedSource

summary2026-09-25

empty to Healthcare AI company Xsolis reported to HHS that a January 2026 phishing attack gave attackers network access, exposing names, SSNs, insurance and treatment data of 1,396,519 people.by seedSource

title2026-09-25

empty to Xsolis phishing breach exposes health data of 1,396,519 peopleby seedSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 1396519by backfillSource

disclosed2026-09-25

2026-06-19 to 2026-06-05by backfillSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2026-01-22by backfillSource

disclosed2026-09-25

2026-07-21 to 2026-06-19by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Xsolis