Healthcare technology company Xsolis said a targeted phishing attack in January led to unauthorized access to part of its network and exposed files tied to 1,396,519 people, according to a company disclosure.
KEY FACTS
- Attack date The phishing attack occurred on Jan. 20, 2026.
- Discovery Xsolis said it noticed unauthorized activity on Jan. 22, 2026.
- Data at risk Files may have included names, addresses, dates of birth, insurance details, Social Security numbers and medical treatment information.
- Response The company said it contained the incident, notified law enforcement and added security measures.
Xsolis develops AI-powered software for hospitals, health systems and health plans and says it serves more than 600 hospitals and health insurers. The company said external cybersecurity experts assisted with the investigation.
The disclosure said affected individuals are being notified by mail. Xsolis also set up a toll-free call center and is offering free credit monitoring and identity protection services for eligible people.
At the time of writing, no threat actor had claimed responsibility for the incident. Xsolis said the access was limited to a portion of its environment, though the exposed data could still include highly sensitive personal and health information.
WHY IT MATTERS
The case shows how a phishing email can lead to broad exposure of personal and medical data even when the initial intrusion is described as limited. For affected people, the main risks are identity theft and misuse of health information.