Social EngineeringTechnologyHealthcareInformationPhishingTargetedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDMinorMediumContained

Xsolis

bd_74c2b18367b0c4ec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 22, 2026

Filed

Jun 5, 2026

To disclose

—

Affected

Not disclosed

Linked

12 filings

Confidence

67%

Full breach record for Xsolis →

Xsolis, Inc. disclosed a targeted phishing attack discovered on January 22, 2026, impacting a limited portion of its case and utilization management environment. The incident exposed protected health information (PHI) and personal data of patients, including minors. Xsolis contained the breach, engaged forensic experts, notified law enforcement, and offered 12 months of identity monitoring via Kroll to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 22, 2026

Discovered

Jun 5, 2026

Filed

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

HHS OCRbd_129f6c41c09a93132026-06-05Verified
Nebraska State AGbd_87e15a1e0d17f6d22026-06-05Verified
California State AGbd_346a5a948fd4d9e02026-06-19 · +14dVerified
Washington State AGbd_fe116170ecddcbeb2026-06-19 · +14dVerified

Show 6 more filings ↓up to 53d gap

Texas State AGbd_d235bbb96662e2042026-06-22 · +17dVerified
New Hampshire State AGbd_451c378a2883b5402026-06-25 · +20dVerified
Massachusetts State AGbd_a6f1904047ec98392026-06-30 · +25dCandidate
California State AGbd_7311690bbe2b92bd2026-07-21 · +46dVerified
Texas State AGbd_26eaa63b7bb2a5b02026-07-23 · +48dVerified
New Hampshire State AGbd_4bbc62dcd7bd237d2026-07-28 · +53dVerified

Showing first 10 of 11 linked disclosures.

Name: Xsolis
norm: xsolis
Domain: xsolis.com

Name: Xsolis
norm: xsolis
Domain: xsolis.com
Industry: TechnologyllmHealthcarellm

Discovered: Jan 22, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government IDMinor
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: phishing_link

During the incident: Engaged external cybersecurity experts
Notified law enforcement
Interrupted and contained the issue
Terminated the unauthorized access
Resetting passwords for all users and key accounts
Increasing monitoring of systems
Deploying new protective technology
Completing the rollout of updated security measures
Accelerating annual security training for employees
Strengthening processes for managing credentials and responding to future incidents
Offering identity monitoring services through Kroll
Changes made: Resetting passwords for all users and key accounts
Increasing monitoring of systems
Deploying new protective technology
Completing the rollout of updated security measures
Accelerating annual security training for employees
Strengthening processes for managing credentials and responding to future incidents
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

HHS OCRJun 5 · first

Nebraska State AGJun 5 · first

Nebraska State AGJun 5 · first · this page

California State AG+14d

Washington State AG+14d

Texas State AG+17d

New Hampshire State AG+20d

Massachusetts State AG+25d

California State AG+46d

Texas State AG+48d

New Hampshire State AG+53d

Pattern: first filing Jun 5 (TN), last Jul 28 (NH) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/865c21c6-9020-4983-8869-65da4fdccce5.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 5, 2026
Raw hash: 1690c8ec61d748b662428da3fde917c4b3aab4ef513d6566d35e874f33f569b0

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityXsolis

Victim entityXsolis

Incidentdiscovered Jan 22, 2026

Stated responseEngaged external cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov