All Breaches
September 1, 2026 Verified Sensitive Record Oncology medical devices

NovoCure 2026 Data Breach

NovoCure Limited said in a September 1, 2026 filing with the U.S. Securities and Exchange Commission that it became aware of unauthorized access to certain information systems in mid-August.

At least 1,400
Affected People
6
Data Types
At least Low
Severity
Oct 9, 2026
Last updated

This classification is based on a reviewed lower bound; the actual impact and severity may be higher.

Protect Yourself

Check whether you were affected by this breach

Check my email

Exposed Data Types

3 sensitive6
  • Internal patient ID numbers
  • Additional identifying information for fewer than 50 U.S. patients
  • General healthcare-provider contact information
  • Employee job titles
  • Employee phone numbers
  • Email addresses

About This Breach

The company said it contained the incident after detection, opened an internal investigation, and engaged independent cybersecurity forensic specialists to assist its assessment. The public filing does not identify when the access began or ended; September 1 is the date NovoCure disclosed the matter publicly.

In NovoCure’s assessment, more than 1,400 U.S. patient records contained only its internal patient ID numbers. The company specifically said that this group of records did not include patient names or other identifying information. It separately reported additional identifying information involving fewer than 50 other patients in the western United States. The review also covered general contact information for healthcare providers, along with employee job titles and phone numbers.

NovoCure said no medical treatment devices were accessed and that its systems remained functional. Its filing does not describe the additional information associated with the smaller patient group, provide a final total of affected people or records, or state how many employees and providers were involved. The company’s forensic review remained ongoing on the filing date.

Verification and editorial method

LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.

Report missing or incorrect information