STLN: Cybersecurity incident

Item 7.01 of a Current Report on Form 8-K filed on November 6, 2025, regarding a cybersecurity incident affecting a software service provider (“Vendor”) utilized by the Company. At the time of the prior voluntary disclosure, the Vendor had indicated that investigation was still ongoing and it could not yet confirm any evidence that any patient personal information was compromised as a result of this incident. However, on May 20, 2026, Kroll, who is the third-party administrator for the Vendor, notified the Company that the Vendor had detected unauthorized access by a third party to certain information systems of the Company, including systems affecting data of patients. The Company believes that the cybersecurity incident has affected various other healthcare service providers, and the Vendor has set up a patient portal through which it intends to provide information and responses to inquiries. Because of the Company’s technology security and continuity plan, the Company worked swiftly in response, and its operations have continued in all material respects since the detection of the incident. The Company remains committed to protecting the healthcare and other personal information of its patients and will work with the Vendor to offer credit monitoring and protection to all impacted patients. The Company is reserving all rights with respect to potential claims against relevant third parties or service providers. Although the Company’s investigation and assessment remain ongoing, as of the date of this filing, the Company believes that the incident has not had a material impact on the Company’s operations, financial systems, or its quality of care to its patients, and the Company is currently evaluating any other material impact, if any, including on its financial condit