FEDERALHackingHealthcareTechnologyHealthcareSupply Chain (3P Vendor)Customer Data InvolvedPIILowContained

The Oncology Institute, Inc.

bd_deda4b07d72f2020 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 3, 2025

Filed

Mar 12, 2026

To disclose

18 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for The Oncology Institute, Inc. →2 incidents on file

The Company (a healthcare IT entity) disclosed a cybersecurity incident involving a third-party software provider on November 3, 2025. The incident caused a brief, immaterial delay in fee-for-service collections. No evidence of patient personal information compromise was found, though investigation is ongoing. Normal billing operations were restored.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 129 days

Nov 3, 2025

Discovered

Mar 12, 2026

Filed

vs. sector median

+7 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

Name: The Oncology Institute, Inc.
norm: the oncology institute
SEC CIK: 1799191

Name: The Oncology Institute, Inc.
norm: the oncology institute
SEC CIK: 1799191
Industry: HealthcarellmTechnologyllm

Discovered: Nov 3, 2025
Materiality determined: Nov 3, 2025
Notification sent: —
Affected individuals: Not disclosed
Data types: PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External

During the incident: Worked closely with the software provider to mitigate the effects
Restored normal billing operations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(129 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1799191/000179919126000007/toi-20251231.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 12, 2026
Raw hash: e5d66f434fe841a9fd2b291e3543daffc743beba43906edc1e98f64d2b88ac8e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 MB

Download View at source

Reporting entityThe Oncology Institute, Inc.

Victim entityThe Oncology Institute, Inc.

Incidentdiscovered Nov 3, 2025

Stated responseWorked closely with the software provider to mitigate the effects

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing