Loading story…
Xsolis, a Tennessee-based healthcare technology company and business associate for HIPAA-covered entities, disclosed a data breach affecting 1,396,519 individuals after attackers gained access to a limited portion of its environment through a targeted phishing attack. The company said unauthorized activity began on January 20, 2026, was detected on January 22, and was then contained by terminating the intruder’s access. The incident has been reported to the US Department of Health and Human Services Office for Civil Rights and added to the HHS breach tracker, confirming the scale of the exposure.
The compromised files contained personal and protected health information received from Xsolis clients, including names, dates of birth, addresses, Social Security numbers, health insurance details, and medical treatment information. Xsolis said the data may have been copied, but it has found no evidence of actual or attempted misuse so far and no ransomware group has claimed responsibility. Confirmed affected healthcare clients include VHC Health and Rochester Regional Health, and Xsolis is offering 12 months of credit monitoring and identity theft protection through Kroll.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
Several healthcare organizations, including Mayo Clinic, Legacy Health, Rochester Regional Health, and UW Medicine, confirmed that their patients were affected by the Xsolis data breach. This added named downstream victims to the incident beyond Xsolis’s previously reported aggregate total.
Xsolis said exposed information included names, dates of birth, addresses, Social Security numbers, health insurance details, and medical treatment information, and stated it found no evidence of misuse. The company also said it is offering 12 months of credit monitoring and identity theft protection through Kroll.
Xsolis reported the breach to the HHS Office for Civil Rights as affecting 1,396,519 patients of its healthcare provider clients. The incident was also added to the HHS data breach tracker, confirming the reported scale.
Reporting on the Xsolis incident identified VHC Health as one of the healthcare provider clients whose patient data was affected. This adds a newly named downstream victim beyond those already publicly linked to the breach.
Xsolis said it began mailing notification letters to people affected by the breach after reporting the incident to regulators and law enforcement. The notices informed impacted individuals about the compromise and available identity protection services.
The California Attorney General’s Office posted a copy of Xsolis’s breach notification, publicly surfacing details of the incident. This posting was noted as occurring on June 19, 2026.
On January 22, 2026, Xsolis detected the unauthorized activity, contained the incident, and terminated the attacker’s access. The company later said the unauthorized access lasted from January 20 to January 22, 2026.
Xsolis said an unauthorized third party accessed a limited portion of its environment beginning on January 20, 2026, after a targeted phishing attack. Files containing personal and protected health information were exposed during the intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
9 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcehipaajournal.com
Open sourcesecurityweek.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcexsolisdataincident.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Unlimited Technology Systems, a Montgomery, Ohio-based provider of revenue cycle management services, disclosed a data breach affecting **3,803,750 individuals** after hackers stole information from one of its commercial data centers. The intrusion occurred between **October 10 and October 15, 2025**, and was discovered on **October 19, 2025**. The company later reported the incident to the US Department of Health and Human Services in late July 2026, and HHS added it to its breach portal. The stolen data included personal, medical, and health insurance information such as **Social Security numbers**, medical record numbers, diagnoses, dates of service, insurance details, and scanned identity documents. Unlimited Technology Systems said full patient medical records, medical imaging, and financial account or payment card data were not exposed, and it has not identified attempted or actual misuse of the stolen information. The company is offering affected individuals two years of credit monitoring, fraud consultation, and identity theft restoration services.
Aug 10, 2026
Multiple healthcare-related breach disclosures expanded significantly, led by *TriZetto Provider Solutions* reporting to regulators that **3,433,965** people were affected after an attacker used a web portal to access historical eligibility reports containing sensitive data (including **SSNs** and insurance information). Separately, *Conduent Business Services* told Wisconsin regulators that its incident now impacts **“25 million-plus”** people nationwide; the Xerox spinoff had previously reported **~15.5 million** affected in Texas, prompting an investigation by Texas AG Ken Paxton, while reporting noted the event is still smaller than the largest U.S. health-data breach on record. Reporting on the *Change Healthcare* ransomware incident reiterated that UnitedHealth estimated roughly **190 million** people were affected, with congressional testimony attributing initial access to a **Citrix remote access portal lacking MFA**, followed by data theft and ransomware deployment; reporting also cited a **$22 million** ransom payment. In the Asia-Pacific region, a separate healthcare privacy incident involving New Zealand’s *ManageMyHealth* patient portal was cited as exposing data from **~120,000** people, and was used to underscore governance, access control, and third-party oversight gaps as recurring drivers of healthcare-sector exposure.
Jun 29, 2026