Social EngineeringHealthcareTechnologyHealthcarePhishingTargetedPHIIdentity (basic)LowContained

Xsolis

bd_a6f1904047ec9839 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 22, 2026

Filed

Jun 30, 2026

To disclose

19 weeks

Affected

Not disclosed

Linked

12 filings

Confidence

66%

Full breach record for Xsolis →

Xsolis, Inc. notified Massachusetts residents of a targeted phishing attack discovered on January 22, 2026. The incident impacted a limited portion of the environment, potentially exposing protected health information and basic identity data of healthcare patients. Xsolis contained the breach, engaged forensic experts, notified law enforcement, and offered 18 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d19 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 23 weeks / 159 days

Jan 22, 2026

Discovered

Jun 30, 2026

Filed

vs. sector median

+8 wks slower

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_451c378a2883b5402026-06-25 · +5dVerified
Texas State AGbd_d235bbb96662e2042026-06-22 · +8dVerified
California State AGbd_346a5a948fd4d9e02026-06-19 · +11dVerified
Washington State AGbd_fe116170ecddcbeb2026-06-19 · +11dVerified

Show 6 more filings ↓up to 28d gap

California State AGbd_7311690bbe2b92bd2026-07-21 · +21dVerified
Texas State AGbd_26eaa63b7bb2a5b02026-07-23 · +23dVerified
HHS OCRbd_129f6c41c09a93132026-06-05 · +25dVerified
Nebraska State AGbd_74c2b18367b0c4ec2026-06-05 · +25dCandidate
Nebraska State AGbd_87e15a1e0d17f6d22026-06-05 · +25dVerified
New Hampshire State AGbd_4bbc62dcd7bd237d2026-07-28 · +28dVerified

Showing first 10 of 11 linked disclosures.

Name: Xsolis
norm: xsolis
Domain: xsolis.com

Name: Xsolis
norm: xsolis
Domain: xsolis.com
Industry: HealthcarellmTechnologyllm

Discovered: Jan 22, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Engaged external cybersecurity experts
Notified law enforcement
Interrupted and contained the issue
Terminated the unauthorized access
Offering identity monitoring services through Kroll for 18 months
Changes made: Resetting passwords for all users and key accounts
Increasing monitoring of systems
Deploying new protective technology
Completing the rollout of updated security measures
Accelerating annual security training for employees
Strengthening processes for managing credentials and responding to future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

HHS OCRJun 5 · first

Nebraska State AGJun 5 · first

California State AG+14d

Washington State AG+14d

Texas State AG+17d

New Hampshire State AG+20d

Massachusetts State AG+25d · this page

California State AG+46d

Texas State AG+48d

New Hampshire State AG+53d

Pattern: first filing Jun 5 (TN), last Jul 28 (NH) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1064-xsolis-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2026
Raw hash: f68ce48954c88d0d201be0ded1184dd531e6479329912a6db7d8c4354e170f2b

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityXsolis

Victim entityXsolis

Incidentdiscovered Jan 22, 2026

Stated responseEngaged external cybersecurity experts

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov