VULNpocalypse
LowBreach / campaignMonitoring

HealthStream discloses cybersecurity incident costs in SEC 8-K filing

HealthStream discloses about $250,000 of Q3 2026 costs from a cybersecurity incident in an SEC 8-K filing; customers should watch for direct notices.

Published
Exploitation
No public evidence, the filing does not describe the cause, method or data involved

What happened

HealthStream, Inc. (Nasdaq: HSTM) discloses a cybersecurity incident in its third quarter 2026 results release, filed with the SEC as Exhibit 99.1 to a Form 8-K dated November 2, 2026 (SEC EDGAR).

According to the filing, operating income for the quarter “was impacted by expense of approximately $250,000 incurred during the third quarter of 2026 related to the cybersecurity incident disclosed by us on July 29, 2026, after giving effect to related insurance recoveries” (SEC EDGAR). HealthStream says it excludes this expense from its adjusted EBITDA figure (SEC EDGAR).

The filing gives only financial details about the incident. The following are not confirmed in the available source:

  • What kind of incident it was.
  • How it started.
  • Which systems, products or data were involved.
  • Whether customer or personal data was affected.

The original July 29, 2026 disclosure that the filing refers to is not among the sources for this advisory. No independent verification is available.

Am I affected?

Not confirmed. The filing does not say whether HealthStream customers, platform users or their data were affected (SEC EDGAR). HealthStream describes itself as a healthcare technology platform company for clinical workforce solutions, including its hStream platform. The filing does not link the incident to any specific product.

What to do now

  1. If you are a HealthStream customer, check for any notice HealthStream has sent your organization about the incident and act on it.
  2. If you have received no notice and need certainty, ask your HealthStream contact directly whether your organization’s data or integrations were in scope. The filing does not answer this.
  3. Watch HealthStream’s SEC filings for further disclosures about the incident.

Sources