Carle Health was impacted by a data security incident at its third-party vendor, XSolis Inc., which occurred on January 22, 2026. XSolis informed Carle Health of the breach on April 23, 2026. Carle Health subsequently posted a notice on its website and patients were notified by XSolis after April 23, 2026, with the incident also reported to the U.S. Department of Health and Human Services (HHS/OCR) on June 19, 2026.
The breach exposed Protected Health Information (PHI) and Personal Identifiable Information (PII) belonging to 1,444 Carle Health patients. The compromised data types include names, Social Security numbers (SSNs), dates of birth, addresses, government IDs, medical diagnoses, treatment dates and locations, health insurance information, and financial information. This incident was part of a larger XSolis breach that affected approximately 1.4 million individuals across seven health systems.
Investigations into this incident are ongoing, and additional details may emerge. Notification timelines and specifics can vary as more information becomes available.