Xsolis Says Phishing Attack Exposed Data of 1.39 Million People
Summary
Xsolis says a targeted phishing attack led to access to files containing personal and medical information of 1,396,519 people. The company contained the incident, notified law enforcement and is offering affected individuals identity monitoring.
Key points
- Xsolis says it detected unauthorized network activity on January 22, 2026, following a targeted phishing attack on January 20.
- The company says attackers accessed files containing names, addresses, dates of birth, health insurance information, Social Security numbers and medical treatment information.
- Data reported to the U.S. Department of Health and Human Services lists 1,396,519 people as affected.
- Xsolis says it contained the activity, investigated with external cybersecurity experts and reported the incident to law enforcement.
- The company reset passwords for users and key accounts, increased monitoring, strengthened credential management and accelerated employee security training.
- Affected individuals are being notified by mail and offered 12 months of identity monitoring and identity theft restoration services through Kroll.
Article Details
- Victim Organization
- Xsolis
- Incident Type
- Targeted phishing attack resulting in unauthorized network access and exposure of customer data
- Incident Date
- 2026-01-20
- Data Types Exposed
- Names
- Addresses
- Dates of birth
- Health insurance information
- Social Security numbers
- Medical treatment information
- Affected Records
- 1,396,519 individuals
- Operational Impact
- Xsolis contained the activity, reset passwords for all users and key accounts, increased system monitoring, strengthened credential management, and rolled out updated security measures. The company said it was not aware of attempted misuse of the exposed information.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed