Novocure Says Cancer Patient Data Exposed in August Break-In

Key points

• Novocure, a global cancer-therapy company, disclosed a cyberattack from mid-August 2025 in a filing with the U.S. Securities and Exchange Commission.
• Attackers reached records for more than 1,400 U.S. Cancer patients, held as ID numbers without names attached.
• Fewer than 50 patients in the western U.S. Had identifying details and their healthcare providers' contact information exposed.
• Some employee contact details were also taken, including job titles and phone numbers.
• Novocure says none of its medical treatment devices were touched and its systems still work normally.

Novocure, the company behind Tumor Treating Fields (a wearable therapy that uses low-level electric fields to slow cancer cell growth), has notified U.S. Regulators that hackers broke into some of its computer systems in mid-August. BleepingComputer first reported the story.

In practice, it's a fairly typical mid-sized healthcare intrusion: sensitive but partial patient data taken, corporate HR-style details scraped, no sign the attackers got anywhere near the machines that actually treat people.

What was actually taken?

The hackers reached records for more than 1,400 U.S. Cancer patients, but those records held only patient ID numbers with no names attached. A much smaller group, fewer than 50 patients in the western United States, had their identifying information exposed along with contact details for the doctors and clinics treating them.

Some Novocure employees were also caught up in it. Contact information for an undisclosed number of staff was exposed, though the company hasn't said how many people that covers.

Novocure hasn't named the group behind the attack and hasn't confirmed whether a ransom was demanded.

Were the medical devices affected?

No. Novocure was clear: "No access to any of our medical treatment devices was obtained, our ability to operate has not been compromised and all of our systems are fully functional."

That matters because Novocure's product sits on patients' bodies. A device compromise would be a very different story. The failure mode here is data theft from corporate systems, not tampering with therapy.

What should patients do?

For the roughly 1,400 patients whose records held only ID numbers, the practical risk is low: without a name attached, an ID number is hard to abuse. The smaller group whose names and provider details were exposed should watch for unexpected contact that seems to know their medical details, and check insurance statements for suspicious activity.

Novocure says it will notify affected patients directly where the law requires it.

A rough month for healthcare

This is the fifth healthcare-breach story Threat Vectr has covered in the last 90 days. We reported on CareCloud on 19 August, after that firm's SEC filing revealed a March breach affecting more than 3.7 million people. Unlimited Technology Systems disclosed an October 2025 incident affecting more than 3.8 million. Nutex Health told the SEC in late August that hackers had walked off with data from its servers, with the full patient count still unconfirmed. McKesson has confirmed a cybersecurity incident after the ShinyHunters extortion crew claimed to hold 284 million patient records, a figure the group hasn't substantiated.

The postmortem on these incidents almost always lands in the same place: the corporate side of a medical company is a softer target than the regulated device side, and attackers have worked that out. Segment your office network from anything touching patients, and treat employee contact lists as already compromised.