iRhythm Data Breach Exposes 368,000 Cardiac Patients' Records

A summer intrusion comes due in the fall

iRhythm Technologies makes the Zio wearable heart monitor. The company is now sending notification letters to patients whose personal information was stolen in a June 2026 cyberattack, and state filings already put the number of victims above 360,000.12 The breach notices filed with state regulators list 298,647 affected people in Texas and 69,526 in South Carolina, and the company also filed notices in California.2 Added together, the two states come to 368,173 people. That figure is only a floor, because iRhythm has not released a national total.18

The company spotted the intrusion on June 8. Its forensic investigation later found that attackers were able to access and download data from business applications hosted by a third party between June 3 and June 8.1 Recorded Future News reports that the attackers got into those applications through social engineering, not a software exploit.2 iRhythm began mailing letters on October 2, after its forensic review and data analysis were finished. The first letters went to people for whom it had contact information.17

What was taken

The stolen data is identity and administrative information rather than clinical records. The company says it includes patient names, postal and email addresses, phone numbers, dates of birth, iRhythm patient account numbers, device serial numbers, insurance numbers and dates of service.17 iRhythm says it does not keep individual financial account or payment card data, so none of that was exposed.17

The reporting is consistent on these categories. There is still no public evidence that ECG traces or diagnostic findings were taken. However, the company's June filing with the Securities and Exchange Commission said the attacker claimed to have proprietary data and protected health information as well as other personal details.2 So the attacker's claims in June were broader than the data categories the company confirmed in October. iRhythm has not addressed that gap in public, and anyone judging the risk should keep it in mind.

Even without clinical files, the stolen records are useful to criminals. An insurance number, a device serial number and a real date of service let a scammer pose convincingly as iRhythm or a health plan when calling or emailing a cardiac patient.6 iRhythm's own advice to patients reflects this. It tells them to watch for medical identity theft, check their insurance statements and consider fraud alerts or credit freezes.19

Extortion, not encryption

The incident has been grouped with ransomware attacks, but no reporting says any systems were encrypted. It looks like data-theft extortion. According to the SEC filing, a threat actor contacted iRhythm on June 9, one day after detection. The actor said it held the stolen data and asked for payment in return for not publishing it.14 No hacking group has claimed the attack publicly.2

The main disagreement in the coverage is whether iRhythm paid. SecurityWeek points to the company's statement that it has no evidence the data "has been or will be used" for identity theft. The outlet argues that this forward-looking wording suggests iRhythm paid the extortionists.1 HIPAA Journal and Recorded Future News take a more cautious line. They note that the filings do not say whether any payment was made or negotiated.46

The more cautious reading is the correct one. Healthcare companies use the phrase "no evidence of misuse" all the time, including when no payment has been made. A promise that data "will not" be misused is the kind of statement a company might make after getting deletion assurances, but it does not prove a payment happened. The fact that no group has claimed the attack and no data has appeared on a leak site fits a paid ransom. It also fits an actor that lost interest, or one that sold the data privately. Until iRhythm says otherwise, whether it paid is still an open question.

How big is it really?

The numbers are less settled than the 360,000 headlines suggest. iRhythm declined to give Recorded Future News a full victim count. A spokesperson would only say that the company notified individuals and regulators once it had confirmed the scope.2 HIPAA Journal says the incident had not yet appeared on the federal Office for Civil Rights breach portal, the usual source for a national total.4

One outlet, Beinsure, cites an aggregation of regulatory filings that lists about 8.18 million affected people nationwide. It also notes that iRhythm has not confirmed any comprehensive total.18 That number is close to HIPAA Journal's description of iRhythm devices being used by roughly 8 million patients in the US and Europe.4 The overlap could mean the breach reached almost the entire patient base. It could also be an artifact of how the aggregator read a filing. Without primary confirmation, the 8 million figure should be treated as unverified. Still, SecurityWeek and HIPAA Journal both say the real total is probably well above the two-state count.14

There is also a timing issue. Patients were told in October about a breach found in June, almost four months earlier. HIPAA's Breach Notification Rule generally requires individual notice within 60 days of discovery, and a compliance analysis from June noted that the clock keeps running while an investigation continues.14 Whether iRhythm met its duties depends on facts not yet public. One factor is whether it acted as a covered entity or as a business associate for particular patient groups, which changes who has to notify whom.14 Regulators and the plaintiffs' lawyers now investigating the breach will likely ask about the delay.16

The vendor layer is the attack surface

The security lesson here has little to do with zero-days or missed patches. In the same week, SecurityWeek covered a critical SonicWall vulnerability that was exploited within days of disclosure, which is a classic patch race.3 iRhythm's breach was different. By every account, the attackers did not need a software flaw or access to the core platform. They needed someone to believe them, and access to business applications run by an outside provider.214

That pattern has become common in healthcare. Help-desk impersonation, MFA-fatigue prompts and pretexting have repeatedly gotten around otherwise modern security stacks. Once inside a legitimate SaaS application, an attacker can download data without setting off malware alerts.14 Neither iRhythm nor the reporting has named the third-party platform or the applications. One analysis points out that without that detail, it is unclear whether the provider was compromised or whether attackers simply abused legitimate credentials.7

The incident also shows a gap in how "impact" is usually framed. iRhythm has stressed in every statement that its products, clinical systems, medical devices, manufacturing and patient safety were not affected.17 That is believable and it matters, because a compromised cardiac monitoring system would be far more serious. But the company's definition of being unaffected leaves out its back-office data, and that is exactly what was stolen. Under HIPAA, protected health information is covered wherever it is stored, including in a vendor-hosted business tool.14 For patients, it makes no difference that the data was taken from a CRM or support platform rather than a clinical system.

A sector under sustained pressure

iRhythm is the latest in a long run of attacks on medical device makers. Recorded Future News counts dozens of incidents over the past two years that affected manufacturers' core business and manufacturing systems.2 Medtronic, Boston Scientific, Stryker, Masimo and Zoll are among the companies that have been targeted.6 The iRhythm news also follows the Oracle Health breach, which SecurityWeek says has grown to nearly 20 million people.1

For investors, the immediate effect looks manageable. iRhythm reported $224.2 million in second-quarter revenue, up 20.1% from a year earlier.12 It says the incident is not reasonably likely to materially affect its finances, and it has cyber insurance.417 The company did warn in its SEC filing that the attack could hurt its brand and patients' trust.4 The move to notifying individuals brings the costs that tend to come later: customer support, legal defense and regulatory questions.12 At least one class-action investigation is already looking for affected patients.16

What to watch

Three things will show how serious this breach is. The first is the HHS breach portal entry, which should settle whether the true count is in the hundreds of thousands or the millions. The second is whether iRhythm names the third-party platform. If the provider is shared by other healthcare companies, this could become a supply-chain story. The third is whether the stolen data ever appears on a leak site or in criminal markets, which would partly answer the payment question.

Whatever the final count, the breach confirms what defenders have been saying for some time: in healthcare, the easiest route to patient data is often an outside vendor's business application, reached by talking someone into granting access.