Xsolis data breach: a phishing attack on a hospital utilization management vendor

What happened in the Xsolis data breach?

The letter is written on behalf of the patient's own healthcare provider, which uses Xsolis for case and utilization management. Xsolis says it contained the activity and ended the access when it found it, brought in outside cybersecurity experts and notified law enforcement, and has seen no unauthorized activity in its environment since January 22, 2026.

Date	What the letter and the regulators' records say
January 20, 2026	Breach date on the California, Washington and Indiana records
January 22, 2026	Xsolis becomes aware of the activity from a targeted phishing attack
June 5, 2026	Report submitted to HHS; Indiana's report gives this as the date notice was sent
June 19, 2026	First notice recorded by California; Washington records the notice that names nine health systems
June 30, 2026	Report logged in Massachusetts
July 21, 2026	Second notice recorded by California
July 23, 2026	Posted on the Texas attorney general's list

134 days passed between the discovery and the HHS report.

Which hospitals' patients were affected?

Washington's list names Alexian Brothers Health System, Banner Health, Hendrick Medical Center (Hendrick Health), Infirmary Health, Legacy Health, Mayo Clinic, Rochester Regional Health, UW Medicine and Virginia Hospital Center alongside Xsolis. The letter itself does not name a provider; it refers to "your healthcare provider".

What information was involved?

The filed letter leaves the data elements as a blank field. Washington lists names, Social Security numbers, full dates of birth, health insurance policy or ID numbers and medical information; Texas lists names, addresses, Social Security numbers, medical and health insurance information and dates of birth. Massachusetts marks medical records as breached and Social Security numbers, financial accounts, driver's licenses and payment cards as not breached.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	1,396,519
Indiana attorney general	Total affected, as reported to Indiana	2,523,302
Indiana attorney general	Indiana residents	2,920
Texas attorney general	Texans	139,424
Massachusetts consumer affairs office	Massachusetts residents	40,172
Washington attorney general	Washingtonians	26,203

Indiana's total is 1,126,783 higher than the federal figure; neither record explains the gap. Xsolis is 17th in the Washington ranking.

What is offered to people who got a letter?

Kroll identity monitoring for 12 months at no cost.

Item	Detail from the letter
Provider	Kroll
Length	12 months
Enrollment	Enroll.krollmonitoring.com/redeem; deadline printed on each letter
Phone	(844) 403-4585, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central

Xsolis says it reset passwords for all users and key accounts, increased monitoring, deployed new protective technology, sped up employee security training and tightened credential management.

Why did I get a letter about Xsolis?

Your hospital or health system uses Xsolis for case and utilization management, so Xsolis held some of your information. The guide to letters from companies you never dealt with explains vendor breaches.

What the documents leave open

• What the phishing attack captured: a password, a session or something else.
• How many hospitals' patients are involved in total.
• Why Indiana's total is so much larger than the federal one.