iRhythm Data Breach Exposes Sensitive Information of Over 360,000 Patients

iRhythm’s Data Breach: What We Know So Far

iRhythm, a company known for its wearable heart monitoring devices, has reported a major data breach. The incident, which occurred in June 2026, involved unauthorised access to business applications hosted by a third party. According to Recorded Future News↗ (opens in a new tab), the breach affected at least 360,000 people, with large numbers of victims in Texas and South Carolina. The company began notifying state regulators and affected individuals in October, several months after the attack.

The breach came to light when iRhythm received communications from a threat actor. The attacker claimed to have obtained sensitive data, including proprietary company information and patient health details, and demanded payment to prevent public disclosure. iRhythm confirmed that some data was indeed exfiltrated (copied out of their systems) during the attack.

Who Is Affected and What Was Taken

The stolen information includes a wide range of personal and medical details. Specifically, the data set covers names, addresses, phone numbers, iRhythm patient account numbers, device serial numbers, insurance numbers, dates of service, and dates of birth. This means that anyone who has used iRhythm’s services, especially those in the states where breach notices were filed, could be at risk of having their personal information exposed.

iRhythm is best known for the Zio Patch, a wearable sensor used for continuous cardiac monitoring. The company stated that the breach did not affect its clinical systems, medical devices, or the delivery of patient care. There was no disruption to operations or manufacturing, and the company’s finances were not impacted, according to their spokesperson.

How the Attack Happened

The attackers gained access through a social engineering attack. Social engineering is a technique where attackers manipulate people into giving up confidential information or access, often by pretending to be someone trustworthy. In this case, the hackers targeted business applications hosted by a third party, not iRhythm’s own clinical or device systems. The attackers had access to the systems between 3 and 8 June 2026, and were able to download sensitive data during this window.

No hacking group has publicly claimed responsibility for the attack. iRhythm has said there is no evidence that the stolen data has been used for identity theft, but the risk remains whenever personal and health information is exposed in this way.

iRhythm’s Response and Regulatory Action

iRhythm responded to the incident by investigating the breach and notifying affected individuals and regulators once the scope was clear. The company has filed breach notices in multiple states, including Texas, South Carolina, and California. In its filings with the US Securities and Exchange Commission (SEC), iRhythm disclosed that it had received a ransom demand from the attacker, but did not comment on whether any payment was made.

The company emphasised that the breach did not affect its core healthcare operations or patient care. However, the exposure of sensitive data still poses a risk to patients, especially if the information is later used for fraud or identity theft.

Context: Medical Device Companies Under Attack

iRhythm is not alone in facing cyberattacks. Over the past two years, several major medical device manufacturers, including Medtronic, Boston Scientific, Stryker, and others, have suffered breaches that exposed sensitive medical data and, in some cases, disrupted supply chains. The healthcare sector is a frequent target for cybercriminals because of the high value of medical and personal data.

What Patients Should Do

If you have received a breach notification from iRhythm, monitor your accounts for suspicious activity and consider placing a fraud alert with credit agencies. Be cautious of unsolicited emails or calls asking for further personal information. If you are an iRhythm patient but have not yet been contacted, you may wish to reach out to the company for information about whether your data was involved.

Uncertainties and Ongoing Questions

At this stage, only one news outlet has reported the breach, and iRhythm has not disclosed the total number of affected individuals. It is also unclear whether the ransom was paid or if any data has surfaced online. Further updates from iRhythm or regulators may clarify the full impact in the coming weeks.