NEWS RELEASES

Legacy Health was informed by its vendor, XSolis, Inc., that unauthorized activity occurred within a limited portion of its IT systems. XSolis, which provides case management services for patient care, identified and immediately contained the activity on January 22, 2026, following a targeted phishing attack.

XSolis identified that the protected health information (PHI) of certain Legacy Health patients may have been accessed as a result of this incident. The information involved may include date of birth, medical record number, health insurance information, and clinical information such as diagnosis, treatment dates, and provider name. The information did not include Social Security numbers or financial information such as credit card numbers.

XSolis reported that there has been no evidence of unauthorized access after January 22, 2026, and no indication that any personal information has been misused. In response to this incident, XSolis engaged external cybersecurity experts, notified law enforcement, and implemented additional security measures.

Legacy Health is providing direct notice to individuals for whom we have sufficient contact information. For some individuals, however, sufficient contact information is not available. As a result, this notice is being provided in accordance with applicable law.

Protecting the confidentiality of the information entrusted to us is something we take very seriously.

If you have questions, please call the XSolis incident support line at 844‑403‑4585, Monday through Friday, 8 a.m. to 5:30 p.m. Central Time.