iRhythm Data Breach Impacts at Least 360,000 People

Between June 3 and June 8, 2026, attackers accessed and exfiltrated personal and account data of iRhythm patients from third-party-hosted business applications. The compromised data includes personal identifiers and device-related information. The breach affected at least 360,000 individuals, with large numbers in Texas and South Carolina. The attackers contacted iRhythm on June 9 with extortion demands. iRhythm has not found evidence of misuse of the stolen data for identity theft and reported no operational impact. The company disclosed the incident in regulatory filings and is notifying affected individuals.

The breach exposed sensitive personal information of at least 360,000 patients, including identifiers that could be used for identity theft or fraud. However, iRhythm currently has no evidence that the stolen data has been or will be used maliciously. There was no reported impact on medical devices, clinical systems, or patient safety. The incident is not expected to materially affect iRhythm's financial condition or operations.

No specific remediation or patch is applicable as this is a data breach incident involving third-party-hosted applications. iRhythm is notifying affected individuals and cooperating with regulators. Organizations should monitor for any updates from iRhythm regarding further mitigation steps or recommendations. No evidence currently suggests additional immediate actions are required.