Threat Intelligence · Privacy
iRhythm data breach exposes information of 8.2 million people
Medical device maker iRhythm has reported a data breach affecting over 8 million people. Hackers stole personal and account data from third-party business applications.
Ross Grant2 min read
The short version
Hackers broke into business systems used by iRhythm, a company that makes wearable heart monitors. They stole personal and account information for over 8 million people. iRhythm says the stolen data has not been used for identity theft, but affected people should stay alert for fraud.
By the numbers
- 8,179,772people affected by the iRhythm data breachSecurityWeek
- June 2026month the breach occurredSecurityWeek
What happened?
Medical device maker iRhythm reported a data breach in June 2026 that exposed the personal and account information of over 8.1 million people. Hackers accessed data from third-party business applications and attempted to extort the company. iRhythm has notified affected individuals and regulators, but says there is no evidence of identity theft so far.
Who is affected
iRhythm, a company known for its wearable heart monitors, reported that 8,179,772 people were affected by a data breach in June 2026. The breach impacted patients whose information was stored in certain third-party-hosted business applications. This figure comes from a filing with the US Department of Health and Human Services (HHS) and matches what iRhythm reported to the Oregon Attorney General’s office. Notification letters have been sent to those potentially affected, and regulators in several states have been informed [SecurityWeek (opens in a new tab)].
What was taken
According to iRhythm’s notices, the hackers accessed a range of sensitive data. This included patients’ names, addresses, dates of birth, email addresses, phone numbers, and specific iRhythm account and device data. The device data included account numbers, serial numbers, insurance numbers, and dates of service. iRhythm said there is no evidence that the stolen information has been used for identity theft so far, but it has encouraged affected people to be alert for medical identity theft and fraud.
How the attack worked
The attackers broke into third-party-hosted business applications used by iRhythm. After stealing the data, they tried to extort the company by threatening to leak the compromised information. The company has not said which third-party applications were involved or how the attackers gained access. There is no evidence that iRhythm’s medical devices, clinical systems, or manufacturing operations were affected. Patient safety and the company’s ability to meet patient needs were not impacted, according to iRhythm [SecurityWeek (opens in a new tab)].
The response
iRhythm began notifying affected individuals and regulators in October 2026, several months after the breach. The company encouraged people to take steps to protect themselves from identity theft, but did not offer free identity or credit monitoring services. iRhythm also stated that there is no sign the stolen information has been used for fraud. The company has not provided details about changes to its security practices or the involvement of law enforcement.
What you should do
If you are a current or former iRhythm patient, watch for a notification letter. Be cautious of emails or calls asking for personal information. Monitor your medical and insurance records for suspicious activity. Consider placing a fraud alert on your credit file if you believe your information was exposed.
Why it matters
This breach affects millions of people who trusted a medical device company with sensitive information. Stolen medical and personal data can be used for identity fraud, even if there is no evidence of misuse yet. The incident highlights risks in third-party business systems.
Key points
- Over 8 million people had personal and device data exposed in the iRhythm breach.
- Hackers accessed third-party business applications and tried to extort the company.
- Stolen data includes names, contact details, and device account information.
- iRhythm says there is no evidence of identity theft so far.
- Affected people should monitor for signs of fraud.
Sources
SecurityWeek
Reference
