[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffsp2z0dc-Te0G1dVahnl7rcb78ynDHZQ11jafeJMeqA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"a647d210-4fa3-4cd5-87ad-d2911c64dd77","novocure-breach-exposes-1400-cancer-patients-data-via-unauthorized-system-access","63a0d160-f78f-423a-8d9a-99433269dcc0","Novocure Breach Exposes 1,400+ Cancer Patients' Data via Unauthorized System Access","Novocure suffered a cyberattack resulting in unauthorized access to systems containing sensitive health and contact information for over 1,400 cancer patients and an undisclosed number of employees. The breach highlights the critical risk of inadequate access controls and insufficient monitoring in healthcare environments where patient data is highly sensitive and heavily regulated. Delayed discovery — with the incident found in mid-August but likely occurring earlier — suggests gaps in real-time detection and logging capabilities. Healthcare organizations handling Protected Health Information (PHI) face severe consequences under HIPAA when access controls and monitoring fail to prevent or promptly detect intrusions.","**Immediate actions:**\n- Audit and revoke all unnecessary or excessive user and system access privileges to patient data systems immediately.\n- Force credential resets and enable multi-factor authentication (MFA) for all accounts with access to PHI or employee records.\n\n**Detection & monitoring improvements:**\n- Deploy a SIEM solution to generate real-time alerts on anomalous access patterns to sensitive health information systems.\n- Conduct a forensic log review to establish the full timeline and scope of unauthorized access across affected systems.\n\n**Long-term improvements:**\n- Implement role-based access control (RBAC) with least-privilege principles for all systems storing patient or employee data.\n- Establish a formal data classification policy that ensures PHI is isolated, encrypted at rest and in transit, and subject to enhanced access logging.\n- Conduct annual third-party penetration testing and access control reviews specifically targeting healthcare data repositories.",[12,13,14,15,16,17,18,19,20,21,22,23],"NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 AU-6 (Audit Review, Analysis, and Reporting)","NIST SP 800-53 IR-4 (Incident Handling)","CIS Control 5 (Account Management)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","HIPAA Security Rule §164.312(a)(1) (Access Control)","HIPAA Security Rule §164.312(b) (Audit Controls)","HIPAA Breach Notification Rule §164.400–414","NIST CSF DE.CM-3 (Personnel Activity Monitoring)","NIST CSF PR.AC-4 (Access Permissions and Authorizations)",{},"published","2026-09-01T16:20:58.396082+00:00","2026-09-01T16:20:58.282+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnovocure-data-breach-affects-more-than-1-400-cancer-patients\u002F","novocure-data-breach-affects-more-than-1-400-cancer-patients-e50e48","Novocure data breach affects more than 1,400 cancer patients",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":62,"name":63,"problem":64},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]