Xsolis: phishing intrusion exposed SSNs and medical data of 1.4M people across health-system clients
Severity: high · Patch status: no-fix-needed · Since 2026-11-03
Xsolis, a US vendor of case and utilization management services to healthcare organizations, says a targeted phishing attack on 2026-01-20 gave an unauthorized actor access to a limited part of its environment from 2026-01-20 until it contained the activity on 2026-01-22. Files the actor acquired may contain names, addresses, dates of birth, health insurance information, Social Security numbers and medical treatment information. Xsolis says it is not aware of any actual or attempted misuse and is offering free credit monitoring and identity protection. The US HHS breach listing shows 1,396,519 individuals, as reported by SecurityWeek and Becker's; the people are patients of Xsolis's provider clients, and Xsolis has not published a client list. Health systems confirmed as affected in primary notices or in named reporting include Mayo Clinic, UW Medicine (about 23,600 patients per its own notice, as TechTarget reports), VHC Health, Rochester Regional Health and United Regional Health Care System; Legacy Health, Carle Health, Augusta Health and Hendrick Health are also reported. No product fix applies. The response is patient notification, vendor-risk review and phishing-resistant authentication for vendor and staff accounts.
What to do
- Notify and support affected patients; monitor for misuse of exposed data
- Review vendor risk and BAAs with Xsolis and similar AI/health-data subcontractors
- Enforce MFA and phishing-resistant authentication for vendor and staff accounts
- Assess what data is shared with third-party AI vendors and minimize exposure
Sources
All live incidents on Threat Watch
