BreachPublished 29 Oct 2026

HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million

Source SecurityWeek

Description

In June 2026, iRhythm, a medical equipment provider specializing in wearable cardiac monitors, suffered a data breach impacting over 8.1 million individuals. Hackers accessed personal information and iRhythm account and device data from third-party-hosted business applications and attempted to extort a ransom. The compromised data includes names, addresses, dates of birth, email addresses, phone numbers, and device-related identifiers. iRhythm has not found evidence of identity theft or impact on its medical devices or operations. Notifications have been sent to affected individuals and regulatory bodies, including the US Department of Health and Human Services.

Impact

The breach exposed sensitive personal and device data of over 8 million individuals, potentially increasing the risk of medical identity theft and identity fraud. However, iRhythm has not identified any use of the stolen information for identity theft or any impact on patient safety, medical devices, or company operations. The breach primarily affects privacy and confidentiality of patient data.

Defensive guidance

iRhythm has notified affected individuals and regulatory authorities. The company advises potentially impacted persons to protect themselves against medical identity theft and identity fraud. No specific remediation or patch is applicable as the breach involved third-party-hosted business applications. Organizations should monitor communications from iRhythm for further guidance. No evidence suggests a need for immediate operational changes or device recalls.

Summary

The June 2026 data breach at iRhythm involved unauthorized access to personal and device-related information stored in third-party-hosted business applications. The attackers stole sensitive data of approximately 8.18 million individuals and attempted ransom extortion. The compromised data set includes patient identifiers and iRhythm account and device details such as serial and insurance numbers and service dates. iRhythm confirmed no evidence of identity theft or operational impact on its clinical or medical device systems. Notifications were issued to affected individuals and regulators, and the incident is listed on the HHS data breach portal.

References

securityweek.com/hhs-filing-puts-irhythm-data-breach-toll-at-8-2-million/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Oct 2026, 08:40 UTC

Technical details

References

Community reviews