iRhythm Breach Affects 8,179,772 People, HHS Filing Shows
A filing on the HHS data breach portal puts the iRhythm incident at 8,179,772 affected individuals. The June 2026 breach at the wearable cardiac monitoring provider involved personal and account/device data stolen from third-party-hosted business applications, plus a ransom extortion attempt. iRhythm is notifying affected individuals and says it has no evidence of identity theft.
What happened
Hackers stole patient data from iRhythm, a wearable cardiac monitoring company known for the Zio monitor, from third-party-hosted business applications in June 2026. The attackers attempted to extort a ransom, threatening to leak the data. An HHS filing quantifies the impact at 8,179,772 individuals.
Why it matters
Stolen data includes names, addresses, dates of birth, email addresses, phone numbers, and account, serial and insurance numbers, creating medical and identity fraud risk. iRhythm says its products, clinical and medical device systems, operations and patient safety were not affected. The scale, over 8 million people, raises regulatory and reputational exposure.
What to do
Notified patients should protect themselves against medical identity theft and monitor their accounts; the company cited no free identity or credit monitoring. Teams should review contracts and security controls for third-party-hosted business applications.
For the technical team
- Affected
- Aplicações de negócios da iRhythm hospedadas por terceiros; dados pessoais, de contas e de dispositivos · iRhythm third-party-hosted business applications. Per the company, no impact to products, clinical or medical device systems, customer connections, manufacturing and distribution, patient safety, or ability to meet patient needs.
- Exploitation
- Hackers stole sensitive data and attempted to extort a ransom, threatening to leak it. iRhythm says it has no evidence that personal information has been or will be used to commit identity theft.
- Fix
- No fix applicable. Mitigation underway: notification letters to potentially affected individuals and notices to regulators in several states and to HHS.
- Vector
- Compromise of iRhythm business applications hosted by third parties; the source does not describe the technical intrusion method.
- More details
- Breach occurred in June 2026 and was disclosed in mid-June. Compromised data: names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data, including account, serial and insurance numbers and dates of service. The 8,179,772 figure is listed on the HHS data breach portal and was previously reported to the Oregon Attorney General's office. iRhythm encourages protection against medical identity theft and identity fraud, but its notice does not mention free identity theft or credit monitoring services.
Timeline
An HHS filing puts the iRhythm data breach toll at 8.2 million people.
