STOCK TITAN

Cyber incident at vendor impacts The Oncology Institute (NASDAQ: TOI) patient data systems

Filing Impact
(Moderate)
Filing Sentiment
(Neutral)
Form Type
8-K

Rhea-AI Filing Summary

The Oncology Institute, Inc. reported a material cybersecurity incident linked to a software service provider it uses. On May 20, 2026, a third-party administrator informed the company that the vendor had detected unauthorized access to certain company information systems, including systems affecting patient data.

The vendor has established a patient portal to share information and handle inquiries. The company states its technology security and continuity plan allowed operations to continue in all material respects after detection. It plans to work with the vendor to offer credit monitoring and protection to impacted patients and is reserving rights regarding potential claims against third parties.

The company’s investigation is ongoing, but as of this filing it believes the incident has not had a material impact on its operations, financial systems, financial condition, or quality of care, while it continues to evaluate any other material effects.

Positive

  • None.

Negative

  • None.

Insights

TOI reports a vendor-related cyber incident involving patient data but currently sees no material operational or financial impact.

The Oncology Institute describes unauthorized access at a third-party software vendor that affected its information systems and patient data. Because this involves a vendor, much of the technical containment and communication is routed through that vendor and its administrator, including a dedicated patient portal.

The company notes its continuity plan allowed operations to continue in all material respects and that, as of this filing, it does not see material impact on operations, financial systems, financial condition, or quality of care. However, it flags potential legal, reputational, and financial risks, including regulatory inquiries or litigation, and is reserving rights for potential claims against third parties.

Future disclosures may clarify the ultimate scope of affected data, any remediation and credit monitoring costs, and whether regulators or patients pursue actions related to the incident. These factors will determine whether the event remains limited or becomes more financially significant.

Item 1.05 Material Cybersecurity Incidents Business
A cybersecurity incident that the company has determined to be material to investors.
Item 7.01 Regulation FD Disclosure Disclosure
Material non-public information disclosed under Regulation Fair Disclosure, often investor presentations or guidance.
Item 9.01 Financial Statements and Exhibits Exhibits
Financial statements, pro forma financial information, and exhibit attachments filed with this report.
Common stock par value $0.0001 par value Common stock par value disclosed in filing
Warrant exercise price $11.50 per share Exercise price for redeemable warrants
Incident notification date May 20, 2026 Date Kroll notified company of unauthorized access
Prior disclosure month and year November 6, 2025 Date of earlier voluntary cybersecurity disclosure
Report signature date May 22, 2026 Date the report was signed by Chief Legal Officer
Material Cybersecurity Incidents regulatory
"Item 1.05 Material Cybersecurity Incidents."
emerging growth company regulatory
"Emerging growth company"
An emerging growth company is a recently public or smaller public firm that qualifies for temporary, lighter regulatory and disclosure rules to reduce the cost and effort of being public. For investors, it means the company may provide less historical financial detail and face fewer reporting requirements than larger firms, so it can grow more quickly but also carries higher uncertainty—like buying a promising early-stage product with fewer user reviews.
forward-looking statements regulatory
"Cautionary Statement Regarding Forward-Looking Statements"
Forward-looking statements are predictions or plans that companies share about what they expect to happen in the future, like estimating sales or profits. They matter because they help investors understand a company's outlook, but since they are based on guesses and assumptions, they can sometimes be wrong.
third-party administrator financial
"Kroll, who is the third-party administrator for the Vendor"
An independent firm hired to handle the day-to-day administration of employee benefit plans, insurance claims, or retirement accounts on behalf of another company or insurer. Like a property manager who takes care of tenants and maintenance, a third-party administrator processes claims, manages paperwork and compliance, and controls how smoothly benefits operate—factors that can affect a company’s costs, regulatory risk and financial predictability for investors.
credit monitoring and protection financial
"work with the Vendor to offer credit monitoring and protection to all impacted patients"
Cover Page Interactive Data File technical
"104 | | Cover Page Interactive Data File (embedded within the Inline XBRL document)"
false 0001799191 0001799191 2026-05-20 2026-05-20 0001799191 TOI:CommonStockParValue0.0001Member 2026-05-20 2026-05-20 0001799191 TOI:RedeemableWarrantsEachWholeWarrantExercisableForOneShareOfCommonStockEachAtExercisePriceOf11.50PerShareMember 2026-05-20 2026-05-20 iso4217:USD xbrli:shares iso4217:USD xbrli:shares

 

 

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

___________________________________

Form 8-K

__________________________________________________________

 

CURRENT REPORT

Pursuant to Section 13 or 15(d)

of the Securities Exchange Act of 1934

 

Date of Report (Date of earliest event reported)  May 20, 2026

___________________________________

 

THE ONCOLOGY INSTITUTE, INC.

(Exact name of registrant as specified in its charter)

___________________________________

 

Delaware   001-39248   84-3562323
(State or other jurisdiction
of incorporation)
  (Commission File Number)   (I.R.S. Employer
Identification No.)

 

18000 Studebaker Road, Suite 800, Cerritos, CA   90703
(Address of principal executive offices)   (Zip Code)

 

Registrant’s telephone number, including area code:  (562) 735-3226

 

 

(Former name or former address, if changed since last report)

 

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:

 

Written communication pursuant to Rule 425 under the Securities Act (17 CFR 230.425)

Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)

Pre-commencement communication pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))

Pre-commencement communication pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

 

Securities registered pursuant to Section 12(b) of the Act:

 

Title of each class   Trading Symbol(s)   Name of each exchange on which registered
Common stock, par value $0.0001   TOI   The Nasdaq Stock Market LLC
Redeemable warrants, each whole warrant exercisable for one share of Common stock, each at an exercise price of $11.50 per share   TOIIW   The Nasdaq Stock Market LLC

 

 

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (17 CFR §230.405) or Rule 12b-2 of the Securities Exchange Act of 1934 (17 CFR §240.12b-2).

 

Emerging growth company ¨

 

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐.

 
 

 

Item 1.05 Material Cybersecurity Incidents. 

 

The Oncology Institute, Inc. (the “Company”) is providing this disclosure, as a follow-up to its voluntary disclosure in Item 7.01 of a Current Report on Form 8-K filed on November 6, 2025, regarding a cybersecurity incident affecting a software service provider (“Vendor”) utilized by the Company. At the time of the prior voluntary disclosure, the Vendor had indicated that investigation was still ongoing and it could not yet confirm any evidence that any patient personal information was compromised as a result of this incident. However, on May 20, 2026, Kroll, who is the third-party administrator for the Vendor, notified the Company that the Vendor had detected unauthorized access by a third party to certain information systems of the Company, including systems affecting data of patients. The Company believes that the cybersecurity incident has affected various other healthcare service providers, and the Vendor has set up a patient portal through which it intends to provide information and responses to inquiries.

 

Because of the Company’s technology security and continuity plan, the Company worked swiftly in response, and its operations have continued in all material respects since the detection of the incident. The Company remains committed to protecting the healthcare and other personal information of its patients and will work with the Vendor to offer credit monitoring and protection to all impacted patients.

 

The Company is reserving all rights with respect to potential claims against relevant third parties or service providers. Although the Company’s investigation and assessment remain ongoing, as of the date of this filing, the Company believes that the incident has not had a material impact on the Company’s operations, financial systems, or its quality of care to its patients, and the Company is currently evaluating any other material impact, if any, including on its financial condition or results of operations.

 

Cautionary Statement Regarding Forward-Looking Statements

This Current Report on Form 8-K contains statements about future events and expectations which are “forward-looking statements” within the meaning of Sections 27A of the Securities Act of 1933, as amended, and 21E of the Securities Exchange Act of 1934, as amended. Forward-looking statements can be identified by forward-looking words such as “may,” “might,” “could,” “would,” “should,” “will,” “anticipate,” “believe,” “plan,” “estimate,” “project,” “expect,” “intend,” “seek,” “are encouraged,” and other similar expressions. Any statement contained in this Current Report on Form 8-K that is not a statement of historical fact may be deemed to be a forward-looking statement. All forward-looking statements involve risks, uncertainties and other factors that may cause actual results to differ materially from those expressed or implied in the forward-looking statements. For example, all statements regarding the impact of the incident described above on the Company and its operations, financial systems, or its financial condition, the scope of the investigation, expectations regarding the adequacy of insurance, the Company’s plans, objectives, projections and expectations regarding the Company’s operations or financial condition, and assumptions related thereto are all forward-looking statements. Factors that might cause the Company’s actual results to differ materially from those anticipated in forward-looking statements include, but are not limited to, the Company’s ongoing assessment of the impacts of the cybersecurity incident, including the Company’s potential discovery of additional information related to the incident in connection with its investigation or otherwise; the Company’s expectations regarding its ability to contain and remediate the cybersecurity incident; the impact of the cybersecurity incident on the Company’s relationships with patients, employees, and governmental regulators; the legal, reputational, and financial risks resulting from the cybersecurity incident, including as may arise from any exfiltrated data or any potential regulatory inquiries and/or litigation to which the Company may become subject in connection with the incident; any further or still undetected cyber security incident; and remediation and other additional costs that may be incurred by the Company in connection with the investigation and remediation of the incident. The forward-looking statements speak only as of the date of this Current Report on Form 8-K. The Company undertakes no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events, or otherwise, except as required by applicable law.

 

Item 9.01. Financial Statements and Exhibits.

(d) Exhibits 

Exhibit
No.
  Description
   
104   Cover Page Interactive Data File (embedded within the Inline XBRL document).

 

 

 
 

 SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

Dated: May 22, 2026 THE ONCOLOGY INSTITUTE, INC.
   
  By: /s/ Minh Merchant
  Name:  

Minh Merchant

  Title:

Chief Legal Officer

 

 

 

FAQ

What cybersecurity incident did The Oncology Institute (TOI) report in this 8-K?

The Oncology Institute reported that a software vendor it uses experienced unauthorized access to certain company information systems, including systems affecting patient data. The incident was communicated by the vendor’s third-party administrator and appears to have also affected other healthcare service providers.

Has The Oncology Institute (TOI) reported any material impact from the cyber incident?

As of this filing, The Oncology Institute believes the incident has not had a material impact on its operations, financial systems, financial condition, or quality of care. The company states its investigation and assessment are ongoing and it is still evaluating any other material effects.

How is The Oncology Institute (TOI) responding to the cybersecurity incident?

The Oncology Institute relied on its technology security and continuity plan, allowing operations to continue in all material respects. It is working with the vendor to set up support through a patient portal and plans to offer credit monitoring and protection to impacted patients while reserving rights against third parties.

How did The Oncology Institute (TOI) learn patient data was affected by the incident?

On May 20, 2026, the vendor’s third-party administrator, Kroll, notified The Oncology Institute that unauthorized access had affected certain company systems, including systems with patient data. An earlier disclosure had indicated the investigation was ongoing and there was then no confirmation of compromised patient information.

Filing Exhibits & Attachments

4 documents