Xsolis
Disclosed Jun 5, 20263 months ago2,523,302 affectedConfirmed
Xsolis phishing breach exposes health data of 1,396,519 people
Healthcare AI company Xsolis reported to HHS that a January 2026 phishing attack gave attackers network access, exposing names, SSNs, insurance and treatment data of 1,396,519 people.
What is known
| People affected | 2,523,302 (as reported by the organization) |
|---|---|
| Disclosed | Jun 5, 2026 |
| Discovered | Jan 22, 2026 |
| Happened | Jan 20, 2026 |
| Attack | Phishing |
| Data exposed | Names, Health, Addresses, Dates of birth, Social Security numbers, Insurance |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Xsolisoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Xsolisatg.wa.gov · Official notice | Official notice |
| HHS OCR breach report: Xsolis (Business Associate, TN)ocrportal.hhs.gov · Official notice | Official notice |
| Healthtech firm Xsolis suffers data breach impacting 1.4 million peoplebleepingcomputer.com · News | News |
| Xsolis data incidentxsolisdataincident.com · Official notice | Official notice |
| Texas Attorney General data security breach report BR-0005192: Xsolisoag.my.site.com · Official notice | Official notice |
| Indiana Attorney General 2026 data breach report: Xsolisin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS OCRtotal | Jun 5 | 1,396,519 |
| Indiana AGresidents of IN | Jun 5 | 154 |
| California AGresidents of CA | Jun 19 | |
| Washington AGresidents of WA | Jun 19 | 26,203 |
| Researchtotal | Jun 23 | 1,396,519 |
| California AGresidents of CA | Jul 21 | |
| Texas AGresidents of TX | Jul 23 | 139,424 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdf · backfill source
- 2026-09-25 · records_basis: hhs to organization · backfill source
- 2026-09-25 · records: 1396519 to 2523302 · backfill source
- 2026-09-25 · attack: hacking to phishing · seed source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","addresses","dob","ssn","insurance"] · seed source
- 2026-09-25 · summary: empty to Healthcare AI company Xsolis reported to HHS that a January 2026 phishing attack gave attackers network access, exposing names, SSNs, insurance and treatment data of 1,396,519 people. · seed source
- 2026-09-25 · title: empty to Xsolis phishing breach exposes health data of 1,396,519 people · seed source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1396519 · backfill source
- 2026-09-25 · disclosed: 2026-06-19 to 2026-06-05 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-01-22 · backfill source
- 2026-09-25 · disclosed: 2026-07-21 to 2026-06-19 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.