iRhythm patient health and contact data stolen through social engineering of third-party business applications
Cardiac-monitor maker iRhythm says attackers tricked their way into third-party-hosted business apps and stole patient data in June, then demanded payment. Notices went out from 2 October. If you get one, watch for medical identity theft and fake iRhythm contacts.
If you wear or have worn a Zio monitor and receive an iRhythm notice, use the support line it gives, watch your insurance statements for unfamiliar claims, and consider a credit freeze. Treat unexpected calls or emails claiming to be iRhythm as suspect.
What’s happening
iRhythm, maker of the Zio heart monitor, told the US securities regulator it found unauthorised activity on 8 June 2026. Attackers used social engineering to reach third-party-hosted business applications and copy patient health and personal information. A threat actor contacted the company on 9 June and demanded payment to avoid publication; iRhythm has not said whether it paid. It reported no impact on medical devices, clinical systems or patient safety. Notices began on 2 October. The stolen data may include names, contact details, dates of birth, insurance numbers, service dates, device serial numbers and patient account identifiers. The company says it holds no payment card or bank details and has seen no evidence of fraud. Its own count has not been published. State filings reported by The Record show at least 360,000 people, and a SecurityWeek headline cites a US health department filing of about 8.2 million, which we could not open and have not confirmed. No group has claimed the attack. Nothing needs patching.
- What
- Breach
- Affects
- iRhythm Technologies patient records (Zio cardiac monitoring service)
- Fixed in
- Nothing to patch
- Since
- 15 June 2026
- Closed
- 9 Oct 2026
Timeline
- Update
The Record reported state filings of at least 360,000 people (298,647 in Texas, 69,526 in South Carolina). iRhythm declined to give a full count, and no group had claimed the attack.
- Update
iRhythm began sending breach notices to affected people, listing names, contact details, dates of birth, insurance numbers, service dates, device serial numbers and account identifiers. It set up a support line and said it had no evidence of fraud.
- Update
BleepingComputer reported the filing. iRhythm did not name an attacker or say how many people were affected.
- Made public
iRhythm's SEC filing confirmed data was taken from third-party-hosted business applications through social engineering. It reported no effect on medical devices or patient safety, and the number of people affected was not given.
- Update
A threat actor contacted iRhythm and demanded payment in exchange for not publishing the stolen information. On 10 June the company judged the incident material.
- Made publicNothing to patch
iRhythm identified unauthorised activity. It later said the intruders had access to third-party-hosted business applications between 3 and 8 June 2026.
Sources
- iRhythm Form 8-K (cybersecurity incident)iRhythm Holdings / SEC · 15 June 2026
- iRhythm discloses data breach, says hackers stole patient infoBleepingComputer · 15 June 2026
- iRhythm begins notifying patients following review of cybersecurity incidentRTTNews · 2 Oct 2026
- iRhythm data breach reportsThe Record · 9 Oct 2026