On January 20, 2026, Xsolis, a U.S.-based healthtech firm, suffered a targeted phishing attack that allowed attackers to access parts of its network containing sensitive customer data. The breach was detected on January 22, 2026, and involved exposure of names, addresses, dates of birth, health insurance information, Social Security numbers, and medical treatment details for approximately 1.4 million people. Xsolis responded by containing the breach, resetting user passwords, increasing system monitoring, strengthening credential management, and accelerating security training. The incident was reported to law enforcement, and affected individuals were notified with instructions for enrolling in identity monitoring and restoration services.

Sensitive personal and medical information of nearly 1.4 million individuals was exposed, including identifiers such as Social Security numbers and health insurance details. While no misuse of the data has been reported, the exposure increases the risk of targeted attacks, identity theft, and fraud for affected individuals. The breach impacts patient confidentiality and could undermine trust in the affected healthcare services.

Xsolis has implemented multiple remediation measures including immediate containment of the breach, password resets for all users and key accounts, enhanced system monitoring, updated security controls, and accelerated employee security training. Affected individuals have been notified and offered 12 months of identity monitoring and restoration services. No further immediate action is required beyond following the company’s guidance and monitoring for suspicious activity.