Xsolis data breach: what happened and what to do

What happened

Xsolis sells software and services that help hospitals and health plans decide whether a patient's care should be billed as inpatient or outpatient. It's a business associate under HIPAA, which means it handles patient data on behalf of providers and insurers. Most people affected never signed up with Xsolis.

According to reporting on its notice, a targeted phishing attack hit Xsolis on January 20, 2026. The company noticed unauthorized activity on January 22 and says the incident is contained. Its breach notice is dated June 5, 2026, and it filed with the Washington and California Attorney Generals and with the U.S. Department of Health and Human Services. The HHS filing lists 1,396,519 people.

The data came from files Xsolis had received from its hospital and health plan clients. Xsolis hasn't published a client list. Mayo Clinic and UW Medicine have put out their own notices, and UW Medicine said about 23,600 of its patients were affected. Xsolis says it isn't aware of any actual or attempted misuse of the information.

What was exposed

The files may include:

• Names and addresses
• Dates of birth
• Health insurance information
• Social Security numbers
• Medical treatment information

Not everyone's file held every item. Your letter spells out what applies to you.

What that lets criminals do

A name, address and date of birth are the core of an identity. Add a Social Security number and someone can try to open credit, file a tax return or apply for benefits as you. Health insurance details support medical identity theft: using your coverage to get care or file claims.

Treatment information is the part that makes phishing hard to spot. A message that references a real hospital stay or your actual insurer reads like a legitimate bill or a records request. Expect calls and texts of that kind for a while, not just in the first few weeks.

What the company did

Xsolis is mailing notices to the people affected and offering free credit monitoring and identity protection to eligible people. It runs a toll-free call center at 844-405-4638, Monday to Friday, 8 a.m. to 5:30 p.m. Central. A possible class action has been reported on behalf of the 1,396,519 people, but a lawsuit isn't a settlement, and no payout has been announced.

What to expect next

Notices went out by mail after the June 2026 filing, so letters may still be arriving, and your hospital or insurer may send its own. Check their websites if you were treated at a large health system recently: Mayo Clinic and UW Medicine have each published a notice.

Keep your letter. If a fraudulent account or claim appears later, a dated notice helps when you dispute it. The credit monitoring on offer is useful, but a freeze does more: monitoring tells you after something happens, a freeze stops new accounts opening in the first place.