The intrusion began on January 20, 2026, when an unauthorized third party bypassed security protocols. Xsolis maintained the compromised environment for 48 hours before detecting and containing the threat on January 22. Forensic analysis later confirmed that attackers successfully accessed and potentially copied files containing names, birth dates, and health insurance information.

Schubert Jonckheer & Kolbe is currently evaluating the incident to determine if affected patients are entitled to damages or if the company must be legally compelled to overhaul its cybersecurity infrastructure. Given the sensitivity of the stolen data, the firm is encouraging those who received breach notifications to review their legal options regarding potential identity theft protections.