Novocure, a global oncology company specializing in Tumor Treating Fields (TTFields) therapy, has confirmed a data breach affecting more than 1,400 U.S. cancer patients and an undisclosed number of employees. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC), stating that unauthorized access to some of its information systems was discovered in mid-August.
A subsequent investigation revealed that attackers gained access to over 1,400 U.S. patient records containing ID numbers. Novocure stated that these specific records did not include patient names or other directly identifying information. However, for fewer than 50 other patients located in the western U.S., the threat actors did access identifying information along with general contact details for their healthcare providers.
The breach also exposed contact information for an unspecified number of Novocure employees, including their job titles and phone numbers. The company has clarified that its medical treatment devices were not accessed, its operational capabilities remain uncompromised, and all systems are fully functional.
Novocure, which employs over 1,300 individuals and operates across North America, Europe, the Middle East, and Asia, emphasized its commitment to safeguarding patient data privacy and security. The company is currently evaluating applicable regulatory and legal notification requirements and intends to make all necessary notifications based on its findings, including directly to affected patients.
Details regarding how the attackers breached Novocure's network or whether the company has engaged with the attackers concerning a ransom payment have not been publicly disclosed.
This incident follows a series of cyberattacks impacting the healthcare sector. In the preceding month, Unlimited Technology Systems reported a data breach from October 2025 affecting over 3.8 million individuals, while CareCloud disclosed a March data breach impacting more than 3.7 million. More recently, Nutex Health began investigating information theft from its servers, and McKesson acknowledged a cybersecurity incident after the ShinyHunters extortion group claimed to have stolen 284 million patient data records.
