Xsolis Data Breach Notice (Washington Attorney General)

The breach notice from Xsolis has placed your name, Social Security number, full date of birth, health insurance policy number, and detailed medical information in the hands of unknown parties. These records belong to 26,203 people, and the filing makes clear that Protected Health Information owned or licensed by a HIPAA covered entity was also exposed.

Because this combination of identifiers and medical details cannot be replaced or cancelled, the consequences are permanent. A Social Security number paired with a date of birth is the exact information needed to open accounts, file fraudulent tax returns, or obtain medical services in someone else’s name. The medical and insurance information adds another layer: it can be used to file false claims, order prescription drugs, or create convincing deepfake identities for long-term fraud.

The 150-Day Gap Between Incident and Notification

The incident occurred on January 20, 2026. Xsolis filed the breach notice with the Washington Attorney General on June 19, 2026 — an interval of 150 days, or nearly five months. The record does not disclose when the organization discovered the incident, so it is impossible to know how long the exposed data may have been accessible before notification began.

What the Exposed Categories Actually Enable

A name, Social Security number, and date of birth together form the foundation of synthetic identity fraud and traditional identity theft. Once an attacker has those three pieces, they can apply for credit, government benefits, or new health insurance using your identity. The addition of your health insurance policy number and medical information makes the records far more valuable on the dark web. Criminals can use them to submit bogus medical claims, obtain controlled substances, or blackmail individuals by threatening to release sensitive treatment details.