Loading story…
Novocure disclosed that unauthorized actors accessed certain company information systems in mid-August, exposing data associated with more than 1,400 U.S. cancer patients. The accessed records contained patient ID numbers but reportedly did not include names or other identifying information; attackers also obtained identifying information for fewer than 50 patients in the western United States and general contact details for healthcare providers.
The incident also exposed contact information, job titles, and phone numbers for an undisclosed number of employees. Novocure said its medical treatment devices were not accessed, operations were not disrupted, and systems remain functional as the company assesses notification obligations.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
ShinyHunters claimed it had attacked Novocure and published a purported 33 GB archive of files allegedly stolen from the company. Novocure had not officially attributed the breach to the group.
In mid-August 2026, Novocure identified unauthorized access to certain information systems. The incident exposed patient and employee-related information, while its medical treatment devices and operational systems were not accessed or disrupted.
Novocure disclosed in an SEC filing that attackers accessed patient ID numbers for more than 1,400 U.S. cancer patients and identifying information for fewer than 50 additional western U.S. patients, as well as healthcare-provider and employee contact information. The company said it was assessing notification obligations and would notify affected parties as required.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcehipaajournal.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourceorkl.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Novo Nordisk disclosed a cyberattack in which attackers accessed a limited number of internal IT systems and copied non-public data tied to some clinical trial participants and healthcare professionals. The stolen clinical trial information included pseudonymized patient identifiers rather than direct identifiers such as names, but it still covered sensitive fields including trial participation details, sex or gender, year of birth, biomarkers, health or immunogenicity data, and lifestyle factors such as smoking status, alcohol use, and BMI. The company said healthcare professional contact and registration details were also exposed, raising the risk of targeted phishing and impersonation attempts over email, phone, and WhatsApp. Novo Nordisk took affected internal systems offline as a precaution, brought in external cybersecurity experts to investigate, and said core business operations were not impacted, while the total number of affected individuals and the full scope of the breach remain under investigation.
Jul 12, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Craneware, a U.K.-based healthcare software company whose products are used by more than 2,000 U.S. hospitals and nearly 10,000 clinics and retail pharmacies, disclosed that attackers breached a subset of its internal data environment and exfiltrated employee, customer, and business partner information. The company said unauthorized individuals viewed and copied a significant volume of file names tied largely to non-sensitive or publicly available regulatory data, but confirmed that some sensitive corporate records were also taken. The company said the intrusion has been contained and that the attackers no longer have access, with no disruption reported to Craneware operations or the hospital services it supports. Craneware said it activated its incident response plan, brought in external cybersecurity and forensic investigators, and notified the FBI and the U.K. Information Commissioner’s Office, while continuing to determine the full scope of the breach and whether any additional impacted data sets are involved.
Jul 22, 2026