On or about January 22, 2026, Xsolis, Inc. (“Xsolis”) became aware of suspicious activity involving a limited portion of its computer environment. According to the Notice of Data Breach, Xsolis identified that the incident resulted from a targeted phishing attack. Upon discovery, the company acted quickly to interrupt and contain the unauthorized activity and terminate access.
Following the initial response, Xsolis launched an internal investigation and engaged third-party cybersecurity specialists to determine the nature and scope of the event. Law enforcement was also notified as part of the company’s response. The investigation determined that certain files may have been accessed without authorization on or around January 22, 2026.
After completing its forensic analysis, Xsolis worked with impacted healthcare providers to identify the individuals whose information may have been affected. Due to the complexity of the data and coordination with its partners, notification letters were sent to impacted individuals following this review process.
Xsolis is a healthcare technology company headquartered in Franklin, Tennessee, that provides case management and utilization review services to healthcare providers and organizations. These services often involve the handling of sensitive patient information in support of medical and administrative decision-making.
As part of its remediation efforts, Xsolis implemented additional safeguards to strengthen its security posture. These measures included resetting passwords across systems, enhancing monitoring capabilities, deploying new protective technologies, accelerating employee cybersecurity training, and improving credential management practices to better prevent unauthorized access in the future.
Xsolis reported that, at the time of notification, there was no evidence that the impacted information had been misused for identity theft or fraud. However, the investigation confirmed that certain personal and protected health information may have been accessed during the incident.
Individuals whose information may have been involved began receiving written notification letters in 2026. If you received a Notice of Data Breach related to Xsolis, it confirms that your personal and/or health information may have been impacted.
As part of its response, Xsolis is offering complimentary identity monitoring services through Kroll for a period of twelve (12) months. These services include credit monitoring, fraud consultation, and identity theft restoration, provided individuals enroll by the deadline listed in their notification letter.
What information is involved in the Xsolis, Inc. Data Breach?
Compromised information may include:
Protected Healthcare Information (PHI)
Personally Identifiable Information (PII)
The specific data elements involved vary by individual and are detailed in each notification letter sent.
Your Personally Identifiable Information (PII) includes data that can be used to identify you, such as your name and other personal details. Healthcare-related organizations are legally required to safeguard this information. When PII is exposed, it may be used by cybercriminals to commit identity theft, financial fraud, or other forms of misuse.
The information potentially involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical and healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be used for medical identity theft, fraudulent insurance claims, or other improper purposes—often in combination with other personal data.
If your information was involved in this incident, it is important to remain vigilant. Impacted individuals are encouraged to regularly review account statements, explanation of benefits (EOBs), and credit reports for any suspicious or unfamiliar activity. Xsolis also recommends following the guidance included in the notification letter, including enrolling in credit monitoring services and considering additional steps such as fraud alerts or credit freezes.
Patients and consumers may have legal rights when companies that handle sensitive healthcare information fail to adequately protect that data. These rights may vary depending on the state and the specific circumstances of the breach.
If you received a Notice of Data Breach related to Xsolis, Inc., your personal and potentially health-related information may be at risk.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.