Almeida Law Group is investigating a data breach at Carle Health. If you were affected, contact Almeida Law Group.
About Carle Health
Carle Health is an integrated health system based in Urbana, Illinois, with more than 17,000 employees, eight hospitals, and a multispecialty physician group with more than 1,500 doctors and advanced practice providers serving communities across central and southeastern Illinois. It combines clinical care, health insurance, research, and academics, and includes the Carle Illinois College of Medicine and the Stephens Family Clinical Research Institute.
What Happened?
Carle Health was listed in an HHS Office for Civil Rights breach portal report submitted on June 19th, 2026, identifying a hacking/IT incident affecting 1,444 individuals. The breached information was located in email, and a business associate was present in the filing.
The incident stems from a phishing attack on Xsolis, a Tennessee-based healthcare AI and utilization management vendor that served as a business associate to Carle Health and several other health systems. On January 20th, 2026, an unauthorized actor accessed portions of Xsolis’s IT environment through a targeted phishing attack. The intrusion was discovered and contained on January 22nd, 2026. Xsolis did not report the breach to HHS until June 5th, 2026 — approximately 135 days after the initial intrusion — raising scrutiny about whether its notification timeline met HIPAA’s 60-day requirement. The broader Xsolis breach affected 1,396,519 individuals across at least seven health systems, including Mayo Clinic, UW Medicine, Legacy Health, VHC Health, Rochester Regional Health, Carle Health, and Augusta Health. Carle Health’s share of that total is 1,444 individuals. No threat actor has publicly claimed responsibility, and Xsolis has stated it is not aware of any misuse of the stolen data.
According to Xsolis’s breach notification and multiple reporting sources, the data involved in the broader Xsolis breach may include names, addresses, dates of birth, health insurance information, Social Security numbers, and medical treatment information, though the specific data types for Carle Health’s affected individuals may vary.
Multiple law firms, including Dapeer Law, P.A., are investigating potential class action claims against Xsolis on behalf of affected individuals. ClassAction.org has reported attorneys investigating the incident on behalf of those affected by the broader Xsolis breach. No class action lawsuit specifically naming Carle Health has been identified in current reporting. Carle Health also has a history of prior data security incidents: a 2016 vendor error exposed patient data for approximately 1,185 patients; a September 2019 phishing incident compromised three physician email accounts containing patient names, medical record numbers, dates of birth, and clinical information; and a HealthAlliance (a Carle Health entity) network intrusion between August and October 2023 potentially exposed names, addresses, dates of birth, Social Security numbers, medical information, health insurance information, and financial information.
Key Facts at a Glance
- Company or Organization: Carle Health
- Industry: Healthcare Provider (integrated health system)
- Location: Urbana, Illinois
- Incident type: Hacking/IT Incident (phishing attack on business associate Xsolis)
- Date of breach: January 20th, 2026
- Date breach discovered: January 22nd, 2026
- Total persons affected: 1,444 (Carle Health); 1,396,519 (total Xsolis breach)
- Prior breach: Yes — 2016 vendor error (1,185 patients), 2019 phishing incident (physician email accounts), 2023 HealthAlliance network intrusion
- Litigation status: Multiple law firms investigating potential class actions against Xsolis; no lawsuit specifically naming Carle Health identified
- Source: HHS Office for Civil Rights breach portal report; Becker’s Hospital Review; HIPAA Journal; ClassAction.org; Dapeer Law
What Should You Do?
If you received a notification that your information was involved in this breach, you should act promptly to protect yourself. Review any Explanation of Benefits statements from your health insurer and check your medical records for services you do not recognize, as health and medical information was potentially involved. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports for unfamiliar accounts or inquiries. You can request free annual credit reports at AnnualCreditReport.com. If Social Security numbers were exposed, a credit freeze is generally the strongest protection available. If you experience signs of identity theft, report them and get a recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
