NovoCure Limited filed a Form 8-K on September 1, 2026, disclosing that in mid-August 2026 the company detected unauthorized access to some of its information systems, exposing limited patient and employee data.

Key Highlights

  • Unauthorized access detected: NovoCure, through a subsidiary, became aware of unauthorized access to some of its information systems in mid-August 2026.
  • Over 1,400 U.S. patient records affected: Internal company patient ID numbers for over 1,400 U.S. patient records were exposed; no patient names or other identifying data for these records was exposed, according to the filing.
  • Fewer than 50 additional patients: Patient data for fewer than 50 other patients in the western U.S. included additional identifying information, the company disclosed.
  • Employee and provider contact information exposed: General contact information for healthcare providers and NovoCure employees, such as job titles and phone numbers, was also accessed.
  • No device access or operational disruption: The filing states "no access to any of our medical treatment devices was obtained, our ability to operate has not been compromised and all of our systems are fully functional."
  • No material financial impact expected currently: The company disclosed it does not currently believe the incident will have a material impact or reasonably likely material impact on its financial condition and results of operations.

NovoCure's Cybersecurity Response and Scope of Data Exposure

According to the filing, NovoCure activated its cybersecurity response plan upon detecting the unauthorized access, implemented containment measures, and initiated an internal investigation. The company also engaged independent cybersecurity forensic experts to assist with the investigation, including reviewing the exposed data that was accessed.

The filing details four categories of exposed data: internal company patient ID numbers for over 1,400 U.S. patient records, which the company notes "are only used internally and no patient names or other identifying data for these was exposed"; patient data for fewer than 50 other patients in the western U.S. that included additional identifying information; general contact information for healthcare providers; and general contact information for NovoCure employees, such as job titles and phone numbers. No access to medical treatment devices was obtained, the company reported.

NovoCure stated it "continues to evaluate applicable regulatory and legal notification requirements and will make all required notifications based on its findings, including to impacted patients." The company added that if additional information leads it to determine the incident will have a material financial impact, it undertakes to file an amendment under Item 1.05 within four business days. The filing was signed by Chief Financial Officer Christoph Brackmann. The company's ordinary shares are listed on NASDAQ:NVCR. The filing includes forward-looking statements that, as the company notes, are subject to risks and uncertainties described in its Annual Report on Form 10-K filed on February 26, 2026, and subsequent filings with the SEC.

What Was Disclosed

NovoCure disclosed a mid-August 2026 cybersecurity incident involving unauthorized access to information systems, limited patient and employee data exposure, no disruption to operations or medical devices, and ongoing evaluation of notification obligations.