iRhythm Data Breach
A cybersecurity incident at iRhythm Holdings, a San Francisco-based heart-monitoring company, resulted in the theft of patient data. iRhythm is a healthcare technology company that manufactures cardiac monitoring biosensors to detect and diagnose heart arrhythmias, which are connected to the Zio cardiac monitoring cloud-based platform. The company started mailing notification letters this month warning that a hacker exfiltrated sensitive patient data. Data breach notices provided to state attorneys general show that this was a significant data breach.
While the total number of affected individuals has yet to be confirmed by iRhythm, at least 298,647 Texas residents and 69,526 South Carolina residents have been affected. The California Attorney General was also notified but does not publicly disclose how many individuals are affected by data breaches. The Zio cardiac monitoring platform is used by around 8 million patients, and some media reports suggest that 8.2 million individuals had data compromised in the incident, although that has not been confirmed by iRhythm.
The incident was first disclosed in a June 2026 filing with the U.S. Securities and Exchange Commission (SEC). iRhythm explained in the Form 8-K filing that the incident was limited to third-party hosted applications and did not affect its medical devices, clinical systems, or customer connections. Business operations were unaffected and continued without disruption, and the company does not believe that the incident will have a material impact on its financial position or results of operations. In August, the company reported that the incident had cost almost $700,000 to date.
iRhythm has confirmed that the incident started with a social engineering attack, which provided access to certain third-party hosted applications between June 3 and June 8, 2026. Between those dates, data was exfiltrated from those applications, and a ransom demand was issued, payment of which was required to prevent the publication of the stolen data. No ransomware group appears to have claimed responsibility for the attack, and it is unclear a ransom was paid.
While this may turn out to be a massive data breach, the information compromised in the incident appears to be limited. iRhythm’s notification letters state that the stolen data included names, addresses, email addresses, telephone numbers, dates of birth, dates of medical services, iRhythm patient account numbers, device serial numbers, and health insurance numbers. While that information would not be sufficient by itself for identity theft, if the data is misused, the affected individuals would face an increased risk of phishing and social engineering attempts, potentially impersonating iRhythm or other healthcare providers.
Users of iRhythm devices should monitor their financial accounts and health insurance statements for signs of data misuse and remain alert to scams. At the time of issuing notifications on October 2, 2026, iRhythm had not identified any actual or attempted misuse of the impacted data.
