Oncology Institute, Inc. discloses a cybersecurity incident (SEC 8-K, May 2026)

What happened

• The Oncology Institute, Inc. (the “Company”) is providing this disclosure, as a follow-up to its voluntary disclosure in Item 7.01 of a Current Report on Form 8-K filed on November 6, 2025, regarding a cybersecurity incident affecting a software service provider (“Vendor”) utilized by the Company.Form 8-K Item 1.05, Oncology Institute, Inc., filed 2026-05-22
• At the time of the prior voluntary disclosure, the Vendor had indicated that investigation was still ongoing and it could not yet confirm any evidence that any patient personal information was compromised as a result of this incident.Form 8-K Item 1.05, Oncology Institute, Inc., filed 2026-05-22
• However, on May 20, 2026, Kroll, who is the third-party administrator for the Vendor, notified the Company that the Vendor had detected unauthorized access by a third party to certain information systems of the Company, including systems affecting data of patients.Form 8-K Item 1.05, Oncology Institute, Inc., filed 2026-05-22
• The Company believes that the cybersecurity incident has affected various other healthcare service providers, and the Vendor has set up a patient portal through which it intends to provide information and responses to inquiries.Form 8-K Item 1.05, Oncology Institute, Inc., filed 2026-05-22