Xsolis health data breach exposes 1.4M records via phishing

Healthcare analytics provider Xsolis has confirmed a data breach that exposed sensitive information of nearly 1.4 million individuals following a phishing attack earlier this year. The incident highlights ongoing vulnerabilities in healthtech platforms that handle both clinical and insurance data at scale.

What happened

On January 20, 2026, attackers successfully executed a targeted phishing attack against Xsolis, a company specializing in AI-powered software for hospitals and health insurers. The unauthorized network access was detected two days later, on January 22, prompting an immediate containment response and an investigation supported by external cybersecurity experts.

The investigation revealed that attackers accessed files containing personal and medical information. Exposed data includes names, home addresses, dates of birth, health insurance details, Social Security numbers, and medical treatment records. According to filings with the U.S. Department of Health and Human Services, the breach impacts 1,396,519 individuals.

Xsolis has reported the incident to law enforcement and is notifying affected individuals by mail. Those whose data was compromised will receive instructions to enroll in a 12-month identity monitoring and restoration service provided by Kroll. For minors affected by the breach, notifications are being sent to parents or legal guardians.

Security response and measures

Following the breach, Xsolis implemented several security enhancements. The company reset passwords for all user and key system accounts, increased system monitoring, and completed the rollout of updated security protocols. Employee security training programs have been accelerated, and credential management processes have been strengthened to reduce the risk of future phishing attacks.

Industry context and implications

Xsolis develops the Dragonfly platform, which processes real-time clinical data to assist healthcare providers and insurers in making decisions about patient care and insurance coverage. The platform is used by more than 600 hospitals and health insurers across the U.S., making it a high-value target for attackers seeking large volumes of sensitive health and personal data.

The breach underscores the persistent threat of phishing attacks in the healthcare sector, where the combination of valuable data and complex, interconnected systems creates significant risk. While Xsolis has not detected any misuse of the exposed information, the incident serves as a reminder for organizations to continuously test and update their security measures, particularly in areas like employee training and credential management.