The Oncology Institute reports patient data exposure through a software vendor

The Oncology Institute, a community oncology practice group, first told investors on November 6, 2025 about a cybersecurity incident at a software provider that could delay some fee-for-service collections. More than six months later, on May 22, 2026, it filed under Item 1.05 after being told that patient data systems had been accessed.

November 2025, Item 7.01

The company's first filing framed the incident as a billing matter. At that time the vendor had not indicated any evidence of compromised patient information.

May 2026, Item 1.05

The later filing recorded new information from the vendor's administrator. The company said other health care providers were affected too, that operations continued, and that it would offer credit monitoring to affected patients.

Not named

Neither filing names the software vendor or gives a patient count. The company has since been renamed in EDGAR records; this entry uses the name on the filings.