Hendrick Health Faces Class Action Lawsuit Over Delayed Data Breach Notification On June 18, 2026, Potts Law Firm filed a class action lawsuit in Taylor County, Texas, against Hendrick Health and its healthcare technology vendor, Xsolis, Inc., on behalf of patient Ada Louise McHenry and others affected by a January 2026 data breach. The lawsuit alleges that a phishing attack on Xsolis a third-party case management provider for Hendrick Health exposed sensitive patient data, including Social Security numbers, medical records, treatment details, and financial information. The breach, discovered on January 22, 2026, went unreported to affected patients until June 2026, exceeding the 60-day notification window required under federal health data protection laws. The lawsuit claims Hendrick Health and Xsolis failed to implement adequate cybersecurity measures and delayed notifying victims, increasing their risk of identity theft, fraud, and medical privacy violations. Plaintiff McHenry, a longtime Hendrick Health patient, alleges her personal and medical data was compromised. The proposed class includes all individuals whose information was exposed in the breach. The lawsuit seeks damages and injunctive relief for alleged negligence in safeguarding patient data and failing to provide timely breach notifications. The case, Ada Louise McHenry v. Hendrick Medical Center and Xsolis, Inc. (Cause No. 52545-A), is pending in Taylor County District Court.

Xsolis Healthcare AI Platform Hit by Phishing Attack, Exposing Sensitive Patient Data On January 22, 2026, Xsolis a provider of AI-driven case management services for healthcare organizations detected unauthorized activity on its network stemming from a phishing attack that occurred two days prior. The breach compromised files containing highly sensitive patient information, including names, addresses, dates of birth, health insurance details, Social Security numbers, and medical treatment records. The exposed data varied by individual. Xsolis’s Dragonfly platform is widely used by over 600 hospitals and healthcare systems, including major institutions like Advent Health, Mayo Clinic, and Honor Health. The company has begun notifying affected individuals via mail. The incident highlights the growing risk of phishing attacks targeting healthcare infrastructure, where AI-driven platforms manage vast amounts of protected health information. Legal investigations are underway to assess potential class action lawsuits on behalf of impacted individuals, focusing on privacy violations, financial losses, and other damages. No further details on the scope of affected patients or the attacker’s identity have been disclosed.

Rochester Regional Health Patients Notified of Data Breach After Phishing Attack Rochester Regional Health has confirmed a data breach affecting approximately 18,600 patients following unauthorized access to a third-party vendor’s system. The incident stemmed from a phishing attack in January, potentially exposing personal and protected health information. Patients received notification letters from Xsolis, Inc., a former vendor whose services ended in 2021. However, the letters contained errors including an incorrect name, "Rochester Regional Medical Center" leading many recipients to dismiss them as scams. Social media reactions reflected widespread skepticism, with some patients discarding the notices before verifying their legitimacy. This is not the first breach for Rochester Regional Health, which experienced similar incidents in 2020 and 2023. In December, the health system secured $15 million in state funding to bolster its cybersecurity defenses. Cybersecurity experts, including Rochester Institute of Technology professor Jonathan Weissman, warned that stolen healthcare data can be exploited for medical fraud, identity theft, and targeted scams. Children’s information is particularly vulnerable, as misuse may go undetected for years. Xsolis stated the unauthorized activity has been contained, with no evidence of data misuse to date. Affected patients were offered free 12-month identity monitoring. Rochester Regional Health emphasized its commitment to patient data security, noting it holds partners to strict privacy standards. The health system has requested corrections to the erroneous notifications.

Rochester Regional Health Patients Receive Confusing Breach Notifications After Vendor Incident Patients of Rochester Regional Health recently received mailed notifications regarding a data breach linked to a third-party vendor, Xsolis a case and utilization management services provider previously used by the healthcare system. The breach, discovered by the vendor, exposed sensitive patient information, though the hospital itself was not directly compromised. The notifications sparked confusion and skepticism among recipients due to several errors. The letters incorrectly identified the facility as "Rochester Regional Medical Center" instead of its proper name, Rochester Regional Health. Many recipients initially dismissed the notices as scams, particularly given the hospital’s history of prior breaches in 2020 and 2023. Rochester Regional Health later confirmed the legitimacy of the breach notifications, attributing the miscommunication to the vendor’s handling of the incident. The incident highlights ongoing challenges in third-party risk management and the importance of clear, accurate breach disclosures in maintaining patient trust.

Healthcare Data Breaches Surge as Third-Party Vendors Become Prime Targets In the first half of 2026, third-party vendors known as business associates were involved in 43% of all large healthcare data breaches reported to U.S. regulators, a sharp rise from the 20% average seen between 2009 and 2017. This trend reflects the growing concentration of sensitive patient data within vendor systems, making them high-value targets for cyberattacks. June alone saw 66 major healthcare breaches, exposing the protected health information (PHI) of 4.5 million individuals. The two largest incidents both targeting business associates compromised data for over 2.6 million people. Among them: - Xsolis, a Tennessee-based AI-powered utilization management firm, suffered a phishing attack in January that granted attackers four days of network access, exposing 1.4 million records. - MCBS, a Georgia-based billing and revenue cycle management company, fell victim to the PEAR extortion group, which stole files containing Social Security numbers, medical histories, and insurance details for 1.25 million individuals. These breaches highlight a critical shift: vendor-side incidents now dominate healthcare data exposure, surpassing traditional breaches at hospitals or health plans. Under HIPAA, covered entities (such as employers with group health plans) remain liable if they fail to ensure vendors comply with security requirements even if the breach occurs at the vendor level. The Spencer Gifts LLC case underscored this risk. In June, the HHS Office for Civil Rights (OCR) settled a $450,000 HIPAA violation fine with the retailer’s benefits plan after a 2021 ransomware attack exposed data for 10,023 members. Investigators found the plan had no risk analysis or HIPAA-compliant policies in place. The enforcement action marked OCR’s 20th ransomware-related settlement and served as a warning to employers that group health plans regardless of industry must adhere to HIPAA Security Rule requirements. The year-to-date breach victim count through June reached 34 million, a decline from 2024 and 2025, though still elevated compared to historical averages. However, hacking accounted for 89.7% of affected individuals in June, reinforcing the need for continuous vendor security assessments rather than one-time compliance checks. As healthcare data becomes increasingly centralized in third-party systems, the cascading impact of vendor breaches grows affecting not just the compromised company but every covered entity in its client network. The trend shows no signs of slowing, with business associate involvement in breaches nearly doubling over the past decade.