At least nine health systems have now confirmed their patients were caught up in a January phishing attack on the healthcare AI company.

 

What happened

A data breach at healthcare AI company Xsolis has affected at least nine health systems and about 1.4 million patients, according to Becker's Hospital Review. Xsolis, which sells AI-driven utilization management and care coordination technology to hospitals and health plans, first disclosed the incident in a June 5 notice.

The notice states a targeted phishing attack on January 20, 2026, gave an unauthorized actor access to part of the Xsolis environment, and the company detected the activity two days later. Xsolis said the actor acquired a "limited number" of files during the intrusion.

 

Going deeper

The health systems confirmed as affected so far are:

  • Erie County Medical Center (Buffalo, N.Y.)
  • Mayo Clinic (Rochester, Minn.)
  • UW Medicine (Seattle)
  • Legacy Health (Portland, Ore.)
  • VHC Health (Arlington, Va.)
  • Rochester Regional Health (Rochester, N.Y.)
  • Carle Health (Urbana, Ill.)
  • Augusta Health (Fishersville, Va.)
  • Hendrick Health (Abilene, Texas)

Xsolis said the exposed information varies by person and may include names, addresses, dates of birth, health insurance information, Social Security numbers, and medical treatment information. The scope also differs by health system. Legacy Health told patients its affected records may include medical record numbers, diagnoses, treatment dates, and provider names, but no Social Security numbers or financial information.

Xsolis said it contained the activity, isolated affected hosts and user accounts, notified law enforcement, and brought in outside cybersecurity experts. It reported no unauthorized activity in its environment since January 22 and no known misuse of the data.

Related: Xsolis announces breach impacting 1.4 million

 

What was said

Rochester Regional Health, which said about 18,600 of its patients were affected, pointed out the breach involved a vendor it no longer works with. In a statement to News10NBC, the system said its "relationship with Xsolis ended in 2021, well before this incident occurred." The notification letters added to the confusion. They misnamed the system as Rochester Regional Medical Center, an entity that does not exist, and News10NBC reported many recipients assumed the letters were scams and threw them away.

 

Why it matters

The Xsolis incident echoes two patterns in Paubox research, namely phishing as a primary attack vector and how one vendor can expose PHI from many organizations. The report, The top 3 healthcare email attacks in 2025, found vendor and business associate email exposure caused 28% of email-related breaches in 2025, the most common pattern in HHS data. Phishing-driven mailbox takeovers accounted for another 17%.

The same research notes that covered entities remain accountable for PHI sent to vendors, and a business associate agreement offers little protection without technical safeguards behind it.

Learn more: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

What is utilization management?

Utilization management is a review process hospitals and health plans use to assess whether a patient's care, such as an inpatient admission, is medically necessary and correctly classified.

 

Who notifies patients when a business associate has a breach?

The business associate must notify the covered entity, which remains responsible for notifying affected patients, although the two may agree to have the business associate send the notices.

 

What should happen to PHI when a vendor contract ends?

HIPAA requires business associate agreements to provide for the return or destruction of PHI at termination, and where this is not feasible, the vendor must extend the agreement's protections to the retained data and limit further uses.