{"id":"irhythm-patient-data-theft-jun-2026","category":"breach","status":"closed","title":"iRhythm patient health and contact data stolen through social engineering of third-party business applications","tldr":"Cardiac-monitor maker iRhythm says attackers tricked their way into third-party-hosted business apps and stole patient data in June, then demanded payment. Notices went out from 2 October. If you get one, watch for medical identity theft and fake iRhythm contacts.","summary":"iRhythm, maker of the Zio heart monitor, told the US securities regulator it found unauthorised activity on 8 June 2026. Attackers used social engineering to reach third-party-hosted business applications and copy patient health and personal information. A threat actor contacted the company on 9 June and demanded payment to avoid publication; iRhythm has not said whether it paid. It reported no impact on medical devices, clinical systems or patient safety. Notices began on 2 October. The stolen data may include names, contact details, dates of birth, insurance numbers, service dates, device serial numbers and patient account identifiers. The company says it holds no payment card or bank details and has seen no evidence of fraud. Its own count has not been published. State filings reported by The Record show at least 360,000 people, and a SecurityWeek headline cites a US health department filing of about 8.2 million, which we could not open and have not confirmed. No group has claimed the attack. Nothing needs patching.","action":"If you wear or have worn a Zio monitor and receive an iRhythm notice, use the support line it gives, watch your insurance statements for unfamiliar claims, and consider a credit freeze. Treat unexpected calls or emails claiming to be iRhythm as suspect.","product":"iRhythm Technologies patient records (Zio cardiac monitoring service)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["irhythm","data-breach","health-data","social-engineering","extortion","patients","medical-identity-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"iRhythm Form 8-K (cybersecurity incident)","url":"https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm","by":"iRhythm Holdings / SEC","date":"2026-06-15"},{"kind":"news","title":"iRhythm discloses data breach, says hackers stole patient info","url":"https://www.bleepingcomputer.com/news/security/irhythm-discloses-data-breach-says-hackers-stole-patient-info/","by":"BleepingComputer","date":"2026-06-15"},{"kind":"news","title":"iRhythm begins notifying patients following review of cybersecurity incident","url":"https://www.rttnews.com/3696264/irhythm-begins-notifying-patients-following-review-of-cybersecurity-incident.aspx","by":"RTTNews","date":"2026-10-02"},{"kind":"news","title":"iRhythm data breach reports","url":"https://therecord.media/irhythm-data-breach-reports","by":"The Record","date":"2026-10-09"}],"started":"2026-06-15","closed":"2026-10-09","created":"2026-11-03T21:34:09.854Z","updated":"2026-11-03T21:34:09.854Z","cve_notes":[],"timeline":[{"at":"2026-10-09","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"The Record reported state filings of at least 360,000 people (298,647 in Texas, 69,526 in South Carolina). iRhythm declined to give a full count, and no group had claimed the attack.","url":"https://therecord.media/irhythm-data-breach-reports","by":"The Record","patch":null},{"at":"2026-10-02","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"iRhythm began sending breach notices to affected people, listing names, contact details, dates of birth, insurance numbers, service dates, device serial numbers and account identifiers. It set up a support line and said it had no evidence of fraud.","url":"https://www.rttnews.com/3696264/irhythm-begins-notifying-patients-following-review-of-cybersecurity-incident.aspx","by":"RTTNews","patch":null},{"at":"2026-06-15","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"BleepingComputer reported the filing. iRhythm did not name an attacker or say how many people were affected.","url":"https://www.bleepingcomputer.com/news/security/irhythm-discloses-data-breach-says-hackers-stole-patient-info/","by":"BleepingComputer","patch":null},{"at":"2026-06-15","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"iRhythm's SEC filing confirmed data was taken from third-party-hosted business applications through social engineering. It reported no effect on medical devices or patient safety, and the number of people affected was not given.","url":"https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm","by":"iRhythm (SEC filing)","patch":null},{"at":"2026-06-09","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"A threat actor contacted iRhythm and demanded payment in exchange for not publishing the stolen information. On 10 June the company judged the incident material.","url":"https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm","by":"iRhythm (SEC filing)","patch":null},{"at":"2026-06-08","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"iRhythm identified unauthorised activity. It later said the intruders had access to third-party-hosted business applications between 3 and 8 June 2026.","url":"https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm","by":"iRhythm (SEC filing)","patch":"na"}],"url":"https://hard.fyi/live/irhythm-patient-data-theft-jun-2026/","json":"https://hard.fyi/api/live?id=irhythm-patient-data-theft-jun-2026"}