Oncology Institute Exposed in Major Data Breach

Post Views: 9

The Oncology Institute Reveals Data Breach Aftermath: A Complex Cybersecurity Incident

The Oncology Institute (TOI), a prominent healthcare provider with a network of over 100 clinics across five states, has disclosed a previously announced cybersecurity incident that impacted patient information.

Background Information:

The breach occurred when a third-party software services provider experienced unauthorized access, compromising sensitive data belonging to patients and potentially other healthcare organizations.
According to the official statement from TOI, the incident was first reported in November 2025, when the organization informed the Securities and Exchange Commission (SEC) about the potential breach.
At the time, the third-party vendor was conducting an investigation, and it was unclear whether patient data had been compromised.
However, on May 20, 2026, the vendor’s administrator, Kroll, notified TOI that unauthorized access had indeed occurred, affecting systems containing patient data.

“We take all allegations of unauthorized access to patient data seriously and are committed to transparency throughout our response efforts,” said [Representative Name] from TOI.

Impact and Investigation:

Law enforcement officials have yet to identify the responsible parties behind the attack. Neither a ransomware group nor any other malicious actors have claimed responsibility for the breach.
Notably, the third-party software vendor involved in the breach is believed to be Cognizant-owned healthcare technology company TriZetto Provider Solutions, which also suffered a data breach earlier this year, impacting multiple customers and approximately 3.4 million individuals.

Risk Management and Response:

TOI has declined to comment further on the matter, citing ongoing investigations.
The organization has, however, established a patient portal to provide information and respond to inquiries related to the breach.

In conclusion, the Oncology Institute’s disclosure highlights the risks associated with third-party risk management in the healthcare sector. Organizations must ensure that these partners prioritize robust cybersecurity measures to safeguard sensitive data.