Back Securityaffairs.Co

Third

Securityaffairs.Co •Pierluigi Paganini • May 26, 2026

The Oncology Institute disclosed a data breach tied to a third-party vendor, potentially exposing patient information after a 2025 cyberattack. The Oncology Institute has confirmed that patient information was impacted in a cybersecurity incident involving a third-party software provider. The healthcare network first disclosed the security breach in November 2025 while the vendor’s investigation was […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oncology Institute Data Breach Exposes Patient Data via Third-Party Vendor On May 20, 2026, The Oncology Institute, Inc. was notified of unauthorized access to its systems by Kroll, a third-party vendor. The incident, confirmed in an SEC filing on May 22, 2026, involved patient data compromise, although specific details on the data types and number of affected individuals remain unverified. This breach follows a previous disclosure in November 2025, which did not confirm data compromise at that time. The incident is part of a growing trend of third-party vendor breaches in the healthcare sector, which now account for approximately 48% of reported breaches. No specific malware or threat actor has been identified, and the investigation is ongoing. Credit monitoring services are being offered to impacted patients. The breach reflects a significant risk within the healthcare supply chain, following a similar incident at TriZetto Provider Solutions in March 2026. 3 sources 61

Extracted Entities

Third

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Industries (1)