Notice of Xsolis Phishing Attack

On April 23, 2026, UW Medicine was informed by our vendor, Xsolis, Inc., that unauthorized activity occurred within a limited portion of its IT systems. Xsolis, which provides case management services for patient care identified and immediately contained the activity on January 22, 2026, following a targeted phishing attack.

Xsolis identified that the protected health information (PHI) of approximately 23,600 UW Medicine patients may have been accessed as a result of this phishing attack. PHI may have included date of birth, medical record number, health insurance provider and clinical information (diagnosis, treatment dates and doctor name). The PHI did not contain Social Security numbers or financial information such as credit card numbers.

Xsolis reported that there has been no evidence of unauthorized access after January 22, 2026, and no indication that any personal information has been misused. In response to this incident, Xsolis engaged external cybersecurity experts, notified law enforcement and implemented additional security measures.

Out of an abundance of caution, we are notifying potentially affected patients and offering complimentary identity monitoring services. We have also reported this incident to the U.S. Department of Health and Human Services, Office for Civil Rights. Protecting the confidentiality of the information entrusted to us is something we take very seriously.

If you have questions, please call the Xsolis incident support line at 844.403.4585, Monday through Friday, 8 a.m. to 5:30 p.m. Central Time.