Shinyhunters has listed NovoCure Limited, the oncology company behind Tumor Treating Fields therapy, on its leak site and is demanding contact by the end of August 24 before publishing stolen files. Threat trackers logged the dark web listing on August 22, and the group described the move as a final warning.
NovoCure makes the Optune system and related devices that deliver electric fields to slow tumor growth in aggressive cancers such as glioblastoma. The company has not publicly confirmed the claim, and ransomware trackers flag the listing as unverified. The group has not yet disclosed what data it says it holds or how many people could be affected.
The claim is corroborated by ransomware.live, GalaxyWarden, and RansomLook, all of which list NovoCure as a Shinyhunters victim dated August 22. Shinyhunters has repeatedly targeted healthcare in recent months, including the DentaQuest breach that exposed 15 million patients and a single-day leak day in August that named Baxter, Cook Medical, and Sharecare.
For a medical device maker, the stakes include not just research and financial data but potentially patient-facing information tied to treatment regimens. Hospitals and clinics that refer patients for Tumor Treating Fields therapy should watch for official disclosure from NovoCure and prepare for the possibility of follow-on phishing aimed at patient populations.
Organizations that hold data from NovoCure partners should treat the claim as a signal to review access logs and vendor contracts. If Shinyhunters follows through with the August 24 deadline, the full scope of any data exposure may only become clear after the leak is published.
