Healthcare technology firm Xolis disclosed a data breach affecting the sensitive information of roughly 1.4 million people. The incident stemmed from a successful phishing campaign that granted attackers unauthorized network access, according to a statement from the company.
Sensitive patient and employee data was exfiltrated during the intrusion, though Xolis has yet to detail the exact categories compromised. The breach underscores the persistent targeting of healthcare organizations by cybercriminals seeking high-value personal and medical records.
The attackers initiated the breach through a targeted phishing email, which allowed them to gain foothold into Xolis's internal systems. Indicators of compromise have not been publicly shared, and the full extent of the data accessed remains under investigation.
Xolis is working with external cybersecurity experts and law enforcement to contain the incident. The firm has begun notifying affected individuals and is implementing additional security measures, though no specific patches or system overhauls have been announced yet.
While the breach is isolated to Xolis, it reflects a broader trend where healthcare firms remain prime targets due to the value of medical data. No threat group has claimed responsibility, and attribution efforts are ongoing.