In January 2026, threat actors executed a targeted phishing attack against Xsolis, a healthcare technology provider, gaining unauthorized access to files containing sensitive personal and protected health information received from its clients. The breach affected approximately 1,396,519 individuals, as reported by the US Department of Health and Human Services. The compromised data includes personally identifiable information and medical details. Xsolis disclosed the incident in June 2026 and indicated no known misuse of the data. There is no indication of ransomware involvement or extortion attempts. The breach highlights risks associated with phishing attacks in healthcare data environments.

The breach exposed sensitive personal and protected health information of nearly 1.4 million individuals, including identifiers such as Social Security numbers and medical treatment information. This exposure increases the risk of identity theft, fraud, and potential privacy violations for affected individuals. However, Xsolis has reported no known misuse of the data to date. The incident may also impact client trust and regulatory compliance obligations for Xsolis.

No specific remediation or patch is applicable as this incident resulted from a phishing attack rather than a software vulnerability. Organizations should continue to implement and enforce strong anti-phishing training and controls. Xsolis has disclosed the breach and is cooperating with regulatory authorities. Monitoring for misuse of the exposed data is recommended. Since this is a breach disclosure rather than a vulnerability with a patch, no direct patch or fix is available.