Cybersecurity Incident at The Oncology Institute Confirmed to Expose Patient Data The Oncology Institute (TOI), a leading oncology provider operating over 100 clinics across five states since 2007, has confirmed that a previously disclosed cybersecurity incident resulted in unauthorized access to patient information. The breach originated from a third-party software vendor, first reported to the SEC in November 2025, though the extent of the impact remained unclear at the time. On May 20, 2026, Kroll, the vendor’s third-party administrator, notified TOI that the vendor had detected unauthorized access to TOI’s systems, including patient data. TOI stated in an SEC filing that the incident likely affected multiple healthcare providers, with the vendor establishing a patient portal for inquiries and disclosures. While TOI has not named the vendor, the breach’s scope and timeline suggest TriZetto Provider Solutions a Cognizant-owned healthcare technology company as the likely source. TriZetto, which Kroll also represents, reported a separate breach earlier this year impacting 3.4 million individuals across its customer base. No ransomware group has claimed responsibility for the attack, and the identity of the threat actors remains unknown. TOI has not provided further details on the number of affected patients or the specific data compromised. The incident adds to a growing trend of healthcare breaches, with recent disclosures affecting hundreds of thousands of individuals at other providers.

Cybersecurity Incident at The Oncology Institute Exposes Patient Data via Third-Party Vendor The Oncology Institute (TOI), a U.S.-based cancer treatment provider with over 100 clinics across California, Oregon, Nevada, Arizona, and Florida, disclosed that patient data was compromised in a 2025 cybersecurity incident involving a third-party software vendor. The breach, first reported in an SEC filing on November 3, 2025, initially appeared to disrupt fee-for-service collections without evidence of patient data exposure. However, a subsequent update on May 20 revealed that threat actors accessed systems containing patient information, as confirmed by Kroll, the vendor’s third-party administrator. TOI stated that its security protocols allowed operations to continue largely unaffected, and the company is collaborating with the vendor to provide credit monitoring and protection for impacted patients. The extent of the breach including the number of affected individuals and whether healthcare data was exposed remains undisclosed.