Cardiac monitoring company iRhythm suffered a data breach affecting 8,179,772 people, according to a federal filing that puts the incident’s impact far above the hundreds of thousands identified in earlier reporting.
The US Department of Health and Human Services’ Office for Civil Rights (HHS OCR) now lists 8,179,772 affected individuals.
Earlier coverage, based on state notifications, identified 298,647 affected Texas residents and 69,526 in South Carolina, totaling 368,173 people. The federal listing establishes a much larger nationwide total.
iRhythm, headquartered in San Francisco, provides wearable Zio electrocardiogram monitors and analysis services that help physicians detect irregular heart rhythms. The company says its technology has analyzed data from more than 12 million patients.
Social engineering led to data theft
The company detected unauthorized activity in certain third-party-hosted business applications on June 8, 2026, and launched an investigation with external cybersecurity specialists.
The forensic investigation later found that unauthorized individuals accessed and downloaded data between June 3 and June 8.
In a June 15 filing with the US Securities and Exchange Commission, iRhythm said it obtained the information through social engineering. It did not identify the affected application providers or describe the specific deception used to gain access.
The filing also disclosed that a threat actor contacted iRhythm on June 9, claiming to possess proprietary information, protected health information, and other personal data. The attacker demanded payment in exchange for withholding the stolen information from public release.
On June 10, iRhythm determined the incident was material because of the volume of potentially affected data.
After reviewing the compromised information, the company began notifying affected individuals for whom it had contact details on October 2.
The exposed information includes:
- Patient names
- Home addresses
- Email addresses
- Phone numbers
- Dates of birth
- Insurance numbers
- Dates of service
- iRhythm patient account numbers
- Device serial numbers
The notice does not list payment card or financial account information among the exposed data. iRhythm says it does not store or retain those details.
The company reports no identified impact on its products, clinical or medical device systems, customer connections, manufacturing and distribution operations, patient safety, or ability to meet patient needs.
iRhythm says it has found no evidence of identity theft involving the compromised information. Nevertheless, its notice recommends precautions against medical identity theft and financial fraud.
Affected individuals should review health insurance explanations of benefits for unfamiliar services and contact their insurer or healthcare provider about discrepancies. The company also recommends reviewing financial statements and credit reports and considering fraud alerts or credit freezes.
Leave a Reply