Xsolis breach affects 1.4 million people across nine health systems

DataBreaches[.]net reports that healthcare AI company Xsolis disclosed a data breach affecting its IT environment, with a targeted phishing incident reported on 5 June and unauthorised access on 20 January, resulting in a “limited number” of files being accessed. The company told the U.S. Health and Human Services (HHS) on 5 June that 1.4 million individuals were affected, a figure later posted by the HHS on 22 June, according to the summary provided by Dissent for DataBreaches[.]net.

Xsolis provides utilisation management and care coordination technology for health systems, and the breach has been linked to at least nine health systems, including major names such as Mayo Clinic in Minnesota and UW Medicine in Seattle, along with Legacy Health, VHC Health, Rochester Regional Health, Carle Health, Augusta Health and Hendrick Health, as listed in the report.

Becker’s Health IT is cited by DataBreaches[.]net as noting the coverage of the incident and the list of affected organisations. The nine systems named by Dissent include Erie County Medical Center in Buffalo, Mayo Clinic in Rochester, UW Medicine in Seattle, Legacy Health in Portland, VHC Health in Arlington, Rochester Regional Health in New York, Carle Health in Urbana, Augusta Health in Fishersville and Hendrick Health in Abilene.

The report specifies that the breach involved a phishing attack and that unauthorised access occurred in January, with the 1.4 million affected figure reported to HHS in June. The article attribute and chronology rely on Becker’s Hospital Review and HHS breach disclosure documentation as the primary sources of record.