Novocure cyberattack exposes 1,400+ US patient records

For health IT and infosecurity leaders, Novocure's breach is less a theft-of-medical-records story than a warning about how much sensitive operational data sits inside specialized device makers. Internal patient IDs, provider contact lists, and employee directories may look low-value, but in the wrong hands they become fuel for phishing, business email compromise, and targeted attacks on cancer care workflows.

On September 1, 2026, oncology device maker Novocure disclosed that a cybersecurity incident involving unauthorized access to certain information systems in mid-August exposed internal records of more than 1,400 U.S. patients. The company said the exposed data included internal company patient ID numbers, general contact information for healthcare providers it works with, and employee details such as job titles and phone numbers. A smaller set of fewer than 50 patients in the western U.S. had additional identifying information exposed. Novocure stated that access to its medical treatment devices was not obtained, that all systems are fully functional, and that it does not expect a material financial impact.

“

The Reuters report cited recent incidents at Abbott, Stryker, Medtronic, Boston Scientific, Novo Nordisk, and West Pharmaceutical Services.

The breach is the latest in a growing wave of cyberattacks against healthcare and medical technology companies. The Reuters report cited recent incidents at Abbott, Stryker, Medtronic, Boston Scientific, Novo Nordisk, and West Pharmaceutical Services. This pattern underscores that medical device and pharmaceutical firms are now prime targets, not only because patient data has lasting value for fraud and extortion, but also because clinical and manufacturing operations make victims more likely to pay or move quickly. For attackers, patient identifiers, provider relationships, and employee directories are reconnaissance tools for deeper social engineering.

For Novocure, known for Tumor Treating Fields therapy used in oncology, the exposure is narrower than a full electronic medical record breach, but it is not inconsequential. Internal patient ID numbers can be linked to treatment histories if combined with other data, while provider contact information and employee phone numbers enable targeted phishing, business email compromise, and impersonation. The company's statement that medical treatment devices were not accessed is important for patient safety, but it also raises the question of whether device networks and enterprise IT are segmented effectively. Security leaders will note that device integrity alone does not eliminate privacy risk.

From a regulatory standpoint, a breach affecting more than 1,400 U.S. patients sits squarely within HIPAA/HITECH notification territory if the data is considered protected health information. Organizations must notify affected individuals, the HHS Office for Civil Rights, and, for incidents over 500 residents of a state or jurisdiction, the media. Novocure has not detailed the specific regulatory notifications it has made, and its public framing that the incident will not be material is aimed at investors. Still, breach response, forensics, legal review, notification, and potential state attorney general inquiries can create meaningful operational costs and reputational drag even when financial statements are not directly hit.