Brass hospital robot guarding a wearable heart monitor and sealed patient files while shadowy hands siphon glowing records — pulp illustration for the iRhythm breach

iRhythm data breach toll hits 8.2 million in HHS filing

Home » Vulnerabilities » iRhythm data breach toll hits 8.2 million in HHS filing

Cardiac-monitoring firm iRhythm has put the toll from its June breach at 8,179,772 people. The figure is now on the US health regulator’s breach portal. Attackers used social engineering to get into third-party-hosted business applications, downloaded patient contact, insurance and device data, then demanded payment to keep it quiet.

What happened

Timeline of the 2026 iRhythm breach: data taken 3 to 8 June, extortion demand 9 June, SEC 8-K 15 June, letters from 2 October, HHS filing 3 October and Oregon AG notice 6 October, both 8,179,772 people
From the first download to the 8.2 million count. Chart: Cyber-Threat.net, from the sources linked below.

iRhythm makes the Zio wearable ECG monitor. In its Form 8-K of 15 June (opens in a new tab) it said it spotted unauthorised activity on 8 June in “certain third-party-hosted business applications”. The next day a threat actor claimed to hold proprietary data and patient health information, and demanded payment not to publish it. The company said the data “was obtained through social engineering”. It has not named the platform or the attacker.

Its forensic review found data was accessed and downloaded between 3 and 8 June. In its notice of 2 October (opens in a new tab), iRhythm lists patient names, postal and email addresses, phone numbers, iRhythm account numbers, device serial numbers, insurance numbers, dates of service and dates of birth. It says it does not store payment card or financial account data, and that clinical and device systems and patient safety were not affected. Letters started going out on 2 October.

The HHS Office for Civil Rights breach portal (opens in a new tab) lists the event as a Hacking/IT Incident on a Network Server, affecting 8,179,772 individuals, submitted on 3 October. That is the same number iRhythm gave the Oregon Attorney General (opens in a new tab) on 6 October, as SecurityWeek reported (opens in a new tab) today. iRhythm has not filed an 8-K/A updating the June Item 1.05 with a headcount, so the HHS and Oregon filings are the first public tally. SecurityWeek also notes that the notice doesn’t offer free credit monitoring. A separate notice for Japan (opens in a new tab) says only names, account numbers and device serial numbers were exposed there.

What to do now

Chart pairing each data type iRhythm says was exposed (contact details, device serial and date of service, insurance number, date of birth, account number) with how criminals typically abuse it
The exposed fields, and how criminals tend to use data like this. The right-hand column is our assessment. Chart: Cyber-Threat.net.

If you wore an iRhythm monitor:

  • Expect phishing. A caller who knows your device serial number and test date sounds real. Don’t pay or share anything on an inbound call, email or text. Ring back on a number you already trust. iRhythm’s incident line is 1-844-770-7175.
  • Read your insurer’s explanation-of-benefits statements and query any service you didn’t receive. That is how medical identity theft usually shows up.
  • Put a free credit freeze or fraud alert in place with Equifax, Experian and TransUnion. Dates of birth and addresses were exposed.

For defenders: social engineering, a hosted business app, a bulk download, then extortion. It’s a familiar pattern.

  • List every SaaS and third-party-hosted app that holds regulated data. Check who can export from each one in bulk.
  • Review OAuth grants and connected apps. Revoke stale tokens, rotate integration secrets and limit who can authorise new connections.
  • Make help-desk and MFA-reset processes resist phone pretexting: call back to verify, and use phishing-resistant MFA for admins.
  • Send SaaS audit logs to your SIEM. Alert on large report exports, API pulls from new IPs or clients, and unusual sign-in locations.
  • Minimise data: a CRM or support tool rarely needs dates of birth and insurance numbers.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)