# Xsolis Data Breach: 1.4 Million Records Compromised > Healthcare AI provider Xsolis reports a major data breach affecting 1.4 million individuals, exposing Social Security numbers and protected health information. - Published: 2026-06-23T09:28:13.000Z - Severity: high - Category: Data Breach - Tags: Xsolis, Healthcare, PHI, Data Privacy, Information Security - Author: Runtime Rebel Intel - Primary source: https://www.securityweek.com/xsolis-data-breach-affects-1-4-million-individuals/ - Canonical: https://runtimerebel.com/blog/xsolis-data-breach-1-4-million-records-compromised ## Key points - Unauthorized access to Xsolis systems compromised personal and protected health information for 1.4 million patients across various healthcare clients. - Affected systems include Xsolis internal environments containing names, addresses, Social Security numbers, medical records, and health insurance details. - Defenders must audit third-party vendor access and enforce strict data encryption standards for all sensitive health information at rest. ## Overview of the Xsolis Data Breach Xsolis, a healthcare technology firm specializing in artificial intelligence and clinical utilization review, has disclosed a significant security incident. According to [SecurityWeek](https://www.securityweek.com/xsolis-data-breach-affects-1-4-million-individuals/), threat actors gained unauthorized access to systems containing personal and protected health information (PHI) pertaining to approximately 1.4 million individuals. This breach highlights the persistent risks associated with the healthcare sector's reliance on third-party technology providers. Xsolis provides services to numerous hospitals and health systems, acting as a critical node in the healthcare [Supply Chain Attack](/glossary#supply-chain-attack) surface. The exposure of data collected from these clients includes sensitive identifiers that could facilitate identity theft or targeted [Phishing](/glossary#phishing) campaigns. ### Scope and Nature of Compromised Data The information exposed during the incident varies by individual but generally includes high-value data points. Forensic analysis confirmed that the following data types were accessed: * Full names and residential addresses * Dates of birth * Social Security numbers (SSNs) * Medical record numbers and health insurance information * Clinical data related to patient care For healthcare organizations, the compromise of SSNs combined with medical history represents a high-severity event, as these data points are static and cannot be easily changed by the victim, unlike credit card numbers. ## Xsolis Data Breach Investigation and Timeline The Xsolis data breach investigation revealed that the unauthorized access occurred within a specific window between June 14 and June 18, 2024. The organization identified the suspicious activity on June 18 and immediately initiated its incident response protocols to contain the threat. While the specific [TTP](/glossary#ttp) used by the attackers have not been publicly detailed, the speed of containment suggests the involvement of a [SOC](/glossary#soc) that monitored for anomalous behavior. Following the discovery, Xsolis engaged external cybersecurity experts to conduct a comprehensive review of the impacted systems. The firm has since notified the U.S. Department of Health and Human Services (HHS) and is in the process of alerting affected individuals. Although there is no current evidence that the stolen data has been utilized for fraud, the risk of [Ransomware](/glossary#ransomware) groups selling this data on dark web forums remains a significant concern for the industry. ### Protecting Patient PHI Against Unauthorized Access This incident underscores the necessity of **protecting patient PHI against unauthorized access** through multi-layered defense strategies. Healthcare providers must recognize that their security is only as strong as their least secure vendor. Implementing [Zero Trust](/glossary#zero-trust) architectures can limit the blast radius if a third-party environment is compromised, ensuring that access to sensitive databases is strictly controlled and verified. ## Mitigation and Security Recommendations To prevent similar incidents, organizations should prioritize the following **security measures for healthcare AI platforms** and general data environments: * **Vendor Risk Management:** Conduct regular audits of third-party service providers. Ensure that vendors like Xsolis adhere to rigorous compliance standards and utilize [EDR](/glossary#edr) solutions to detect early signs of intrusion. * **Data Minimization:** Only share the minimum necessary amount of PHI with third-party vendors. Reducing the volume of data stored externally decreases the impact of a potential breach. * **Encryption and Access Control:** Implement AES-256 encryption for data at rest and utilize robust Identity and Access Management (IAM) policies to enforce the principle of least privilege. * **Monitoring and Detection:** Use a [SIEM](/glossary#siem) to aggregate logs from all cloud and on-premise environments. Rapid detection of unauthorized [lateral movement](/glossary#lateral-movement) is essential for preventing large-scale data exfiltration. Victims of the Xsolis breach are being offered credit monitoring and identity restoration services. However, the broader healthcare community must treat this as a signal to reinforce their internal defenses and demand greater transparency from technology partners regarding their incident response capabilities. **Related:** [Nacogdoches Memorial Hospital Data Breach: 250,000 Records Stolen](/blog/nacogdoches-memorial-hospital-data-breach-250000-records-stolen), [Radiology Associates of Richmond Breach Affects 266,000 Patients](/blog/radiology-associates-of-richmond-breach-affects-266000-patients) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/xsolis-data-breach-1-4-million-records-compromised