iRhythm Technologies, which makes the Zio wearable cardiac monitor, began notifying affected individuals on October 2, 2026, about a breach that took place in June. The company says unauthorized individuals accessed and downloaded data from third-party-hosted business applications between June 3 and June 8. Its notice says the incident affected personal information including protected health information as defined under HIPAA. iRhythm has not published a total count of affected people. Notices filed with two state regulators show 298,647 people in Texas and 69,526 in South Carolina, according to SecurityWeek.
What happened
In a Form 8-K filed under Item 1.05, the SEC's material-cybersecurity-incident item, and signed June 15, iRhythm Holdings said that on June 8 it identified unauthorized activity involving data maintained on "certain third-party-hosted business applications." The filing says the affected data was obtained through social engineering. It does not name the applications, the third-party providers, or the social-engineering technique.
On June 9, the filing says, the company received communications from a threat actor claiming to have obtained sensitive information, "including proprietary data, patient protected health information and other personal information," and demanding payment in exchange for not publicly disclosing it. iRhythm said it has since confirmed that certain data was exfiltrated from those applications. On June 10 it determined the incident was material "in light of the volume of the potentially affected data."
The company's October 2 Notice of Data Event fills in the window. After completing its forensic investigation, iRhythm says, it learned that data it stores was accessed and downloaded by unauthorized individuals from June 3 to June 8, a window that began five days before the activity was detected. Notifications to individuals began nearly four months after detection.
Who is affected and what was taken
The Notice of Data Event lists the following impacted data elements:
- Patient name, postal address, email address and phone number
- Date of birth
- iRhythm patient account number
- iRhythm device serial number
- Patient insurance number
- Date of service
iRhythm says it does not store or retain individual financial account or payment card information. Social Security numbers are not among the data elements listed in the notice, and the 8-K does not mention them.
The affected count comes from state filings, not from iRhythm. The Texas and South Carolina figures count only residents of those two states, and SecurityWeek wrote on October 12 that "the total number of impacted patients is likely significantly higher." The 8-K said the investigation into the categories and volume of data and the individuals affected was continuing, and that the company would amend the filing as it learned more.
What is known, and what is not
Confirmed by iRhythm: unauthorized access to third-party-hosted business applications through social engineering; data downloaded June 3–8; an extortion demand on June 9; the incident judged material on June 10; the data categories listed above. In the 8-K and the October notice, the company says it has identified no impact on its products, clinical or medical device systems, connections to customers, manufacturing and distribution operations, patient safety, or its ability to meet patient needs. The 8-K adds that financial reporting systems were not affected and that the company believes the incident is not reasonably likely to have a material impact on its financial condition or results.
Claimed by the attacker: possession of proprietary data, patient PHI and other personal information, as described in the 8-K. iRhythm has confirmed that certain data was exfiltrated, but has not said whether everything the actor claimed to hold was actually taken.
Unknown: whether iRhythm paid. Neither the 8-K nor the October notice addresses it. The notice says iRhythm has "no evidence that any personal information has been or will be used to commit identity theft." SecurityWeek wrote that this statement suggests the company gave in to the extortionists; that is the publication's inference, and iRhythm has not confirmed any payment. Neither iRhythm nor SecurityWeek names the threat actor.
The company has set up a call center for affected individuals at 1-844-770-7175, open 8:00 a.m. to 8:00 p.m. Eastern, Monday through Friday, excluding holidays. Its notice includes guidance on fraud alerts, security freezes, free credit reports and reviewing explanation-of-benefits statements.
What It Means for Defenders
- Treat SaaS help-desk and login flows as part of your attack surface. Tighten identity checks for password and MFA resets, and prefer phishing-resistant MFA, such as FIDO2 keys or passkeys, for any account that can export patient or customer records.
- Audit bulk exports from hosted business applications. Review export, report and API download activity in CRM, support and analytics platforms that hold PHI. Alert on large or unusual pulls, especially by newly enrolled devices or recently reset accounts.
- Map where regulated data lives outside clinical systems. Inventory non-clinical platforms that hold patient identifiers or insurance data and apply the same access reviews used for core clinical systems.
- For affected patients: follow the fraud-alert and security-freeze steps in iRhythm's notice, request a year-to-date list of paid services from your insurer, and be wary of calls or emails that cite your device serial number or date of service.
