Open report — full analysis, no account required.
Sign up to generate reports and read filings that aren't on the open list.
Get notified when TOI files again. Create a free account and we'll email you the moment its next filing is analyzed.
Get filing alertsOncology Institute confirms patient data breach from vendor cybersecurity incident
Filed May 22, 2026 · Period ending May 20, 2026 · ~1 min read
Key Changes
-
high
Third-party vendor breach confirmed May 20, 2026: unauthorized access to patient information systems including personal healthcare data. Follow-up to November 2025 voluntary disclosure.
Item 1.05 verify on EDGAR → -
high
Company states no material impact on operations, financial systems, or patient care quality to date, but still evaluating potential effects on financial condition and results.
Item 1.05 verify on EDGAR → -
medium
Credit monitoring and protection services will be offered to all affected patients, representing direct remediation costs from the breach.
Item 1.05 verify on EDGAR → -
medium
Company reserves all legal rights against vendor and third parties, signaling potential future litigation or recovery efforts.
Item 1.05 verify on EDGAR → -
medium
Operations continued in all material respects due to technology security and continuity plan, demonstrating operational resilience.
Item 1.05 verify on EDGAR →
Summary
The Oncology Institute disclosed that a vendor cybersecurity incident first reported in November 2025 has been confirmed as a patient data breach. On May 20, 2026, Kroll notified the company that unauthorized third parties accessed patient information systems.
While management states operations, financial systems, and patient care quality remain unaffected, the company is still evaluating potential financial impacts—a critical hedge that leaves material uncertainty on the table.
For retail investors, this creates two immediate concerns: the direct costs of credit monitoring for affected patients and potential regulatory penalties or class-action litigation common in healthcare data breaches. The company has reserved legal rights against the vendor, suggesting recovery efforts may partially offset costs. Watch for the next quarterly earnings call for quantification of breach-related expenses and any updates on patient notification scope or regulatory investigations. Healthcare data breaches often carry long-tail liabilities that emerge months after initial disclosure.
Section-by-Section Diff
Event · Item 1.05
Company disclosed a material cybersecurity incident as a follow-up to a prior voluntary disclosure.
Added in current filing · verify on EDGAR → · paraphrased
The Oncology Institute, Inc. (the “Company”) is providing this disclosure, as a follow-up to its voluntary disclosure incident
The Company disclosed a material cybersecurity incident under Item 1.05, indicating this is a follow-up to a previous voluntary disclosure. The filing appears incomplete or truncated, as the sentence does not finish. This suggests an ongoing cybersecurity matter requiring formal 8-K disclosure beyond the initial voluntary communication.
Event · Item 7.01 — Regulation FD Disclosure
Vendor cybersecurity incident confirmed patient data breach; operations continue, credit monitoring offered to affected patients.
Added in current filing · verify on EDGAR →
on May 20, 2026, Kroll, who is the third-party administrator for the Vendor, notified the Company that the Vendor had detected unauthorized access by a third party to certain information systems of the Company, including systems affecting data of patients.
The Company disclosed that a vendor's cybersecurity incident, previously reported in November 2025 as under investigation, has now been confirmed to involve unauthorized access to patient data. Kroll, the third-party administrator, notified the Company on May 20, 2026 of the breach affecting patient information systems.
Added in current filing · verify on EDGAR →
The Company remains committed to protecting the healthcare and other personal information of its patients and will work with the Vendor to offer credit monitoring and protection to all impacted patients.
The Company will offer credit monitoring and protection services to all affected patients through coordination with the vendor. This represents a direct cost and ongoing obligation resulting from the breach.
Added in current filing · verify on EDGAR →
Because of the Company’s technology security and continuity plan, the Company worked swiftly in response, and its operations have continued in all material respects since the detection of the incident.
The Company's security and continuity plan enabled swift response and maintained operations in all material respects following incident detection. This demonstrates operational resilience despite the data breach.
Thanks — your feedback helps us improve report quality.
Figures/quotes linked to EDGAR · Narrative written by AI · May 24, 2026 · How we verify