Xsolis discloses phishing breach affecting nine Health systems and 1.4 million patients

Healthcare AI company Xsolis, based in Franklin, Tennessee, said a targeted phishing attack gave an unauthorized person access to its IT systems on January 20, 2026, and that it reported the incident on June 5, 2026; the intrusion affected at least nine health systems, and the patient count reached 1.4 million.

On January 20, 2026, an unauthorized person accessed Xsolis’ IT environment and acquired a limited number of files, the company said. It described the acquired material as limited in scope without specifying how many files the person accessed or what they contained. Xsolis told the U.S. Department of Health and Human Services about the breach on June 5, 2026, and HHS published its tally of 1.4 million affected individuals on June 22, 2026.

The affected health systems include Erie County Medical Center in Buffalo, N.Y.; Mayo Clinic in Rochester, Minn.; UW Medicine in Seattle; Legacy Health in Portland, Ore.; VHC Health in Arlington, Va.; Rochester Regional Health in New York; Carle Health in Urbana, Ill.; Augusta Health in Fishersville, Va.; and Hendrick Health in Abilene, Texas. Xsolis identified these nine systems as affected by the breach.

The notification triggers HIPAA breach-notification obligations, requiring Xsolis to disclose the incident to affected individuals and to the U.S. Department of Health and Human Services. HHS posted the breach notification on June 22, 2026, following Xsolis’ report on June 5, 2026. HHS published the figure roughly two and a half weeks after Xsolis first told the agency about the breach.

An unauthorized person entered Xsolis’ systems on January 20, 2026, and the company did not report the access to HHS until June 5, 2026.

Xsolis provides utilization management and care coordination technology that enables collaboration between healthcare providers and payers. The Dragonfly platform helps with AI-driven utilization management, discharge planning, and clinical workflow decisions. Revenue cycle leaders and clinicians use the platform, along with utilization management nurses and care managers, to make faster, more consistent care decisions, reducing friction between providers and payers. The company says the tool aims to improve efficiency across the healthcare system.

Founded in 2013 as an AI-first business, Xsolis introduced its first predictive model, the Care Level Score, in 2015. Xsolis stresses ethical AI development and has broadened its AI capabilities to cover generative and agentic models. Dragonfly launched in September 2024. The platform has surpassed 10 billion AI-powered predictions, which draw on level-of-care decisions and real-world medical necessity data.

The company describes the milestone as evidence of long-term refinement and learning from encounters with real patients. Xsolis defines a prediction as any AI-generated result tied to a patient encounter, including calls about level of care, decisions on patient status, discharge planning, and moves to post-acute care. The company said its client base grew by 64% since Dragonfly launched, disclosing the figure alongside the 10-billion-prediction milestone.

Xsolis says its collaboration network connects more than two-thirds of the hospitals and health systems it serves to health plans. The company serves more than 615 hospitals and health systems. A Definitive Healthcare ranking of discharge volume puts seven of the 10 largest integrated delivery networks on the Xsolis client list. The research firm KLAS has recognized Xsolis for Physician Advisory Services for five consecutive years, and Xsolis calls Dragonfly the first and only platform to use real-time predictive analytics to assign a medical necessity score and assess expected level of care for each patient.

Dragonfly Navigate came out in August 2025 as a tool for discharge planning and capacity management, pulling length-of-stay analytics into clinical workflows. West Tennessee Healthcare was the first pilot user and uses the discharge-planning tool to spot and fix avoidable delays in patient discharges. During a three-month Beacon Health System pilot in June 2025, the generative AI tool cut initial medical necessity review time by 68%, from 15 minutes down to 4.7 minutes per review, and reduced how long payer approvals took, from a four-to-five-day span down to two days.

In August 2026, Xsolis released its third generative AI capability, GenAI Peer-to-Peer Clinical Synopsis, through Dragonfly Advise. That marked the third generative AI capability since Dragonfly’s 2024 launch. In December 2024, the company signed its first generative AI pilot. The pilot aimed to help clinicians with documentation and appeal letters, and the company described it as a way to cut the administrative work involved in clinical documentation and payer appeals.

At a May user conference, Xsolis previewed new business intelligence and agentic AI features. The company showed upcoming analytics and autonomous AI capabilities following its August 2026 generative AI release, and said client availability was expected in the coming months.

The attack on Xsolis points to a rise in targeted phishing against healthcare IT systems, creating downstream risk for health-system partners. The incident points to weaknesses in healthcare AI vendors and the systems that connect them. The incident fits a broader pattern of cyber attacks on healthcare technology companies, including Quest Diagnostics, AdaptHealth, and Veradigm, which often involve unauthorized access, data theft, and exposure of sensitive patient information.