Novocure hit by cyberattack exposing patient data

Novocure has become the latest medtech company to be hit by a cyberattack, with the oncology specialist revealing that unauthorized access to some of its information systems exposed patient and employee data.

The company said in a Sept. 1 SEC filing that it “became aware of unauthorized access to some of its information systems” in mid-August.

The exposed data included internal company patient ID numbers for more than 1,400 U.S. patient records. Novocure said those numbers are used only internally and that “no patient names or other identifying data for these was exposed.”

Patient data for fewer than 50 other patients in the western U.S. was also exposed and “included additional identifying information.”

The breach also exposed general information for healthcare providers the company works with, as well as general information for Novocure employees, including job titles and phone numbers.

On the plus side, Novocure said no access to its medical treatment devices was obtained and that its “ability to operate has not been compromised and all of our systems are fully functional.”

The company said it is continuing to investigate the incident and evaluate regulatory and legal notification requirements, including notifications to affected patients. It does not currently believe the incident will have a material impact on its financial condition or results of operations.

The company markets Optune Pax , its tumor-treating fields device for locally advanced pancreatic cancer. The device is used in conjunction with gemcitabine and nab-paclitaxel.

The disclosure comes just days after fellow medtech Boston Scientific was hit by a cyberattack that caused greater operational disruption, affecting manufacturing as well as the processing and shipping of customer orders.

This year is turning into an annus horribilis for the medtech industry when it comes to cyberattacks. Novocure and Boston Scientific join Medtronic, Stryker, Abbott and iRhythm among medtech companies hit by cyber incidents in 2026.