When Novocure disclosed its August 2026 cyberattack, the immediate questions weren't about what happened but what to do next. These are the questions I hear in Slack channels, post-incident reviews, and CISO roundtables. If you're running security for a medical technology company, device manufacturer, or healthcare IT vendor, you're likely asking them too.
The answers here draw from the Novocure incident and similar medtech breaches in 2026, plus the frameworks you're already using. No theory, just practical steps when you're 48 hours into an investigation and the board wants updates.
Do We Need Third-Party Forensics, or Can Our Team Handle It?
You need external help, and you need it fast.
Novocure brought in third-party cybersecurity forensics experts immediately after detecting unauthorized access in mid-August 2026. This is standard practice because your internal team is already managing containment, coordinating with legal, and keeping operations running. Forensics requires dedicated focus on evidence preservation, timeline reconstruction, and attribution.
More importantly, external forensics firms provide defensibility. When filing with the SEC or notifying state attorneys general under breach notification laws, you'll cite forensic findings. Those findings carry more weight when they come from a recognized firm not defending its own security decisions.
Budget for forensics retainers before you need them. The firms worth hiring are already engaged when breaches hit. If you're scrambling to find forensics support during an active incident, you're starting negotiations at a disadvantage.
What Counts as "Material Impact" for SEC Disclosure Purposes?
This one keeps general counsels up at night, and it should.
Novocure stated in its Form 8-K that it doesn't believe the incident will materially impact its financial condition or operations. That's a judgment call based on operational continuity, data exposure scope, and business disruption. In their case: no device access, no operational impact, systems fully functional, approximately 1,400 U.S. patients affected with limited data types exposed.
But "material" isn't just about revenue. The SEC's 2023 cybersecurity disclosure rules require reporting incidents that a reasonable investor would consider important. That includes reputational harm, regulatory penalties, customer churn, and remediation costs.
Work with your CFO and general counsel to define materiality thresholds before an incident. Document the factors you'll consider: customer count affected, data types exposed, operational downtime, estimated remediation costs, and regulatory risk. When you're three days into an incident, you don't want to be debating what "material" means while the 4-day disclosure clock is ticking.
How Do We Segment Patient Data to Prevent Broad Exposure?
The Novocure breach exposed approximately 1,400 U.S. patients' internal company ID numbers, with fewer than 50 patients having additional identifying information exposed. That's effective data segmentation, the breach didn't cascade across all patient records.
Start with network segmentation that isolates patient databases from general corporate systems. Apply the Principle of Least Privilege ruthlessly: if a system doesn't need access to patient names, it shouldn't have it. Use separate databases for operational data (internal IDs, treatment schedules) and identity data (names, addresses, Social Security numbers).
ISO/IEC 27001 Annex A control 8.1 (User endpoint devices) and 8.20 (Networks security) provide the baseline. For healthcare-specific guidance, HITRUST CSF control 01.c (Network Segmentation and Segregation) maps directly to this requirement. HIPAA Security Rule § 164.312(a)(1) requires access controls that limit electronic protected health information to authorized users.
The practical test: if an attacker compromises one system, can they pivot to patient identity data? If yes, your segmentation isn't working.
Should We Disclose the Threat Actor or Attack Method Publicly?
Novocure didn't disclose the threat group or attack vector in its SEC filing. That's a deliberate choice, and often the right one.
Public attribution is complicated. If you name a threat actor incorrectly, you've just created a legal liability. If you describe the attack method in detail, you've given other attackers a blueprint. And if you're still investigating, premature disclosure can compromise the forensics.
The legal minimum is what regulators require: HIPAA Breach Notification Rule requires notification to affected individuals, the Department of Health and Human Services, and potentially the media, but it doesn't require technical details. SEC Form 8-K requires material cybersecurity incidents to be disclosed, but the focus is on business impact, not technical attribution.
Your disclosure should answer: what data was affected, what you're doing about it, and what individuals should do to protect themselves. Save the technical details for law enforcement and your incident response retrospective.
How Quickly Should We Activate Our Incident Response Plan?
Immediately. Not "after we assess the situation" or "once we confirm it's real."
Novocure activated its incident response plan as soon as it detected unauthorized access. That's the correct sequence: detect, activate, investigate, not detect, investigate, then decide whether to activate.
Your Computer Security Incident Response Team should have clear activation criteria documented in advance. Unauthorized access to systems containing patient or employee data meets that threshold automatically. So does any access that bypasses authentication, any malware detection on production systems, or any anomalous data exfiltration.
NIST SP 800-61r2 (Computer Security Incident Handling Guide) outlines the incident response lifecycle: Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity. The preparation phase includes defining activation triggers so you're not making judgment calls during an incident.
If you're debating whether to activate your incident response plan, you've already waited too long.
What's the Risk When Employee Contact Information Gets Exposed?
Higher than you think, especially for medtech companies.
Novocure reported that general contact information for employees, including job titles and phone numbers, was exposed. That sounds minor compared to patient data, but it's a foothold for social engineering attacks.
Attackers use employee directories to craft targeted phishing campaigns. They know who works in IT, who handles patient support, who has access to treatment devices. Job titles tell them who to impersonate and who to target. Phone numbers enable vishing attacks that bypass email security controls.
After a breach that exposes employee information, brief your staff on elevated social engineering risk. Update your security awareness training to include specific scenarios: calls claiming to be from IT asking for password resets, emails referencing the recent incident to establish credibility, messages from "executives" requesting urgent access changes.
NIST Cybersecurity Framework (CSF) 2.0 function PR.AT (Awareness and Training) requires ongoing security awareness programs. Make employee data exposure part of that program, not an afterthought.
How Do We Compare Our Breach Response to Others?
Context matters. Novocure's breach affected approximately 1,400 U.S. patients with limited data exposure. Compare that to the 2026 incidents at Unlimited Technology Systems and CareCloud, which involved unauthorized access to 3.8 million and 3.7 million patient records respectively, or Boston Scientific's attack that disrupted operations globally.
The difference isn't luck, it's preparation and containment speed. Novocure had an incident response plan ready to activate, brought in forensics support immediately, and implemented containment measures that prevented the breach from spreading.
Benchmark your response capabilities against these factors: time to detection, time to containment, scope of data exposure, operational impact, and recovery time. Don't just compare breach counts, compare response effectiveness.
Where Should We Focus Our Security Investments?
Three areas consistently separate limited breaches from catastrophic ones:
Detection speed. The faster you detect unauthorized access, the less time attackers have to move laterally and exfiltrate data. Invest in endpoint detection and response tools, security information and event management platforms that correlate access patterns, and behavioral analytics that flag anomalous activity.
Segmentation depth. Network segmentation, database isolation, and access controls determine whether a breach affects 1,400 records or 3.8 million. Review your architecture with a threat model that assumes initial compromise, then ask what stops lateral movement.
Response readiness. Incident response plans that sit on SharePoint don't help. Run tabletop exercises quarterly, maintain forensics retainers, and document your SEC disclosure process before you need it.
The medtech companies that recovered quickly from 2026 breaches had these capabilities in place before the attacks. The ones still dealing with operational disruption and regulatory scrutiny didn't.
You can't prevent every attack, but you can control how bad it gets. Start there.
