Xsolis AI Breach Exposes 1.4 Million Patients at Nine US Health Systems

A data breach at healthcare artificial intelligence company Xsolis has now been tied to at least nine United States health systems and 1.4 million patients, according to reporting published on November 4, 2026, that pieced together the full scope of an intrusion first disclosed months ago. The Xsolis AI breach is a reminder that a single technology supplier can expose sensitive medical and personal records held by hospitals that patients never dealt with directly.

The files taken were not limited to names and addresses: dates of birth, Social Security numbers, medical treatment information and health insurance details, a combination usable for identity theft and medical fraud long after a breach is announced.

Key Points

• At least nine US health systems and 1,396,519 individuals are now tied to the breach, per figures reported to the Department of Health and Human Services.
• A targeted phishing attack on January 20, 2026, gave an unauthorised person access to portions of its IT environment and a "limited number" of files, Xsolis told regulators.
• Named systems include Mayo Clinic, UW Medicine, Legacy Health, Carle Health, VHC Health, Rochester Regional Health and Erie County Medical Center.
• Data taken included names, addresses, dates of birth, Social Security numbers, medical treatment information and health insurance information.
• Xsolis said it is not aware of any misuse; no ransomware group has claimed responsibility.

What Happened

Xsolis provides utilisation management and care-coordination technology used by hospitals to review whether treatments meet medical-necessity criteria, giving it access to patient information flowing between providers and insurers. That is why a breach at one vendor can ripple across many health systems.

According to the account summarised on November 4 by DataBreaches.net, Xsolis told US regulators on June 5, 2026, that a targeted phishing attack on January 20, 2026, allowed an unauthorised person to enter portions of its IT environment and reach files held in its systems. Xsolis described the number of files involved as a "limited number", a phrase that sits awkwardly beside the scale of the affected population: nearly 1.4 million people.

The Department of Health and Human Services posted the figure of 1,396,519 affected individuals on June 22, 2026. The new reporting has matched that total to the systems involved: a supply-chain incident, not a single hospital's failure.

Individual notices followed: UW Medicine said about 23,600 of its patients were affected, and Rochester Regional Health put its figure at about 18,600.

Background/Context

Healthcare is among the most frequently targeted sectors for cyberattacks, precisely because medical records are both sensitive and durable. A credit card can be cancelled in minutes; a date of birth, a Social Security number and a medical history cannot. That permanence is why health-data breaches carry longer consequences, and why large incidents must be reported to Health and Human Services.

The Xsolis case fits a pattern that has troubled regulators for years. Hospitals increasingly rely on outside firms for core functions, from billing to utilisation review, so each vendor relationship expands the circle holding patient data. A weakness in any one of them can expose patients who chose their hospital, not the vendor, and notification then takes months while data is reviewed.

The timing illustrates that lag: the attack took place in January 2026, the report to regulators followed in June, and the consolidated picture only emerged in November. For patients, exposure may have happened long before they received any letter.

Xsolis AI Breach: What Data Was Taken and Who Is Affected

The categories of data involved are the most serious part of this story. Names and addresses alone are a nuisance; combined with dates of birth and Social Security numbers, they can support new-account fraud and tax fraud. Add medical treatment information and health insurance details, and the risk extends to medical identity theft, in which someone else's insurance is used to obtain care, leaving false records and unexpected bills.

The named systems span the country: Mayo Clinic in Rochester, Minnesota; UW Medicine in Seattle; Legacy Health in Portland, Oregon; Carle Health in Urbana, Illinois; VHC Health in the Washington area; Rochester Regional Health in upstate New York; and Erie County Medical Center in Buffalo, New York. Together with at least two further systems, they account for the 1.4 million total. Patients who received care coordination or utilisation review through Xsolis should watch for notification letters explaining what data of theirs was involved.

Reactions/Quotes

Xsolis has said it is not aware of any misuse of the data and is notifying affected patients. It characterised the files reached as a "limited number", without publicly detailing how that relates to the 1.4 million people whose information was in them.

No ransomware group has claimed responsibility, and no extortion demand has been publicly reported. Here the harm, if any, is quieter and slower: data taken, patients notified, and a long period of vigilance ahead.

Why It Matters

First, the breach shows how concentrated risk has become in American healthcare: a patient can choose a hospital carefully and still have sensitive information exposed through an unknown vendor, pressuring hospitals to vet suppliers and limit vendor data access.

Second, the combination of data taken is unusually dangerous. Social Security numbers and medical histories do not expire, so victims may need to monitor credit and medical records for years, at a cost in time and attention for an incident they did not cause.

Third, the incident arrives in a year already marked by very large healthcare breaches, including the Marathon Health breach affecting about 5.7 million people. Together they strengthen the case for faster notification, clearer vendor accountability and stronger phishing defences.

What Happens Next

Affected patients should check their notification letter carefully: it should say which of their data categories were involved. Anyone who believes they are affected but has not heard anything should contact their health system, and take up any credit monitoring offered.

Regulators and the health systems will face questions about how a single phishing attack in January could expose files affecting 1.4 million people, and what has changed to prevent a repeat. Watch for further system notices, any update from Xsolis on misuse, and any regulatory findings.

For the wider industry, the lesson is clear: phishing remains the most common way in, and one compromised credential can expose vast amounts of patient data.

Frequently Asked Questions

What is Xsolis? A healthcare technology company providing utilisation management and care-coordination tools used by hospitals to review medical necessity.

How many people were affected? 1,396,519 individuals, per Xsolis's report to the Department of Health and Human Services, posted June 22, 2026, now tied to at least nine health systems.

Which health systems were affected? Mayo Clinic, UW Medicine, Legacy Health, Carle Health, VHC Health, Rochester Regional Health and Erie County Medical Center, among at least nine.

What data was taken? Names, addresses, dates of birth, Social Security numbers, medical treatment information and health insurance information.

Has the stolen data been misused? Xsolis said it is not aware of any misuse, and no ransomware group has claimed responsibility. Patients should still monitor credit and medical statements.

Related coverage: Marathon Health data breach exposes 5.7 million people's medical and Social Security data; StatStrip glucose meter recall hits hospitals in FDA's most serious warning.