Xsolis breach exposes patient data at nine health systems

A data breach at AI company Xsolis exposed patient data across at least nine health systems, affecting about 1.4 million individuals, according to reporting cited by Dissent’s Giles Bruce. Xsolis, which provides utilisation management and care coordination technology, said the intruder conducted a targeted phishing campaign and gained unauthorised access to parts of its IT environment on 20 January. The company notified the U.S.

Department of Health and Human Services on 5 June and disclosed the total affected to the HHS on 22 June, with Becker’s Health IT corroborating the figure.

The health systems named as affected include Erie County Medical Center (Buffalo, New York), Mayo Clinic (Rochester, Minnesota), UW Medicine (Seattle), Legacy Health (Portland, Oregon), VHC Health (Arlington, Virginia), Rochester Regional Health (New York), Carle Health (Urbana, Illinois), Augusta Health (Fishersville, Virginia) and Hendrick Health (Abilene, Texas). The report notes that Xsolis disclosed a “limited number” of files were accessed during the intrusion.

The piece attributes the breach specifics to Becker’s Health IT and DataBreaches[.]net’s coverage of the incident, with the nine systems listed as reportedly affected. The article does not provide further detail on data types involved or any demonstrated exploitation beyond the initial phishing intrusion and the subsequent data access.