Xsolis, a Tennessee-based healthcare technology provider specializing in utilization management and revenue cycle solutions, experienced a data breach due to a targeted phishing attack on January 20, 2026. Unauthorized actors accessed sensitive files containing personal and protected health information received from Xsolis clients. The breach impacted approximately 1,396,519 individuals. The compromised data includes personally identifiable information and health-related data. Xsolis has stated it is unaware of any actual or attempted misuse of the information. The breach was disclosed publicly in early June 2026 and is recorded in the HHS breach tracker. No ransomware group has claimed responsibility, and no ransom payment information is available.

The breach exposed sensitive personal and protected health information of nearly 1.4 million individuals, including identifiers such as names, dates of birth, addresses, Social Security numbers, health insurance information, and medical treatment details. This exposure poses significant privacy risks and potential for identity theft or fraud. However, Xsolis has reported no known misuse of the compromised data to date. The incident affects a large number of individuals and involves highly sensitive healthcare data, which is subject to regulatory protections.

No specific remediation or patch is applicable as this is a data breach incident resulting from a phishing attack. Xsolis has disclosed the breach and is presumably managing incident response. There is no indication of ransom payment or ongoing exploitation. Organizations should monitor official communications from Xsolis and regulatory bodies for updates. Affected individuals should be notified and advised on protective measures such as credit monitoring. Patch status is not applicable. Check vendor advisory and official sources for any further guidance.