iRhythm Holdings (NASDAQ: IRTC), the San Francisco company behind the Zio wearable heart monitor, has confirmed that attackers stole patient data from third-party-hosted business applications between June 3 and June 8, 2026. They then demanded payment to keep the data private. State breach filings made the week of October 6 list 298,647 affected people in Texas and 69,526 in South Carolina, which comes to 368,173 across just those two states. iRhythm also filed in California. The company has not published a national total. A company spokesperson declined to give one to The Record, and HIPAA Journal notes the incident is not yet on the HHS Office for Civil Rights breach portal. One law firm's breach page claims a much higher total of 8,179,772. No other source supports that figure, and it should be treated as unverified until HHS posts its number.
What Happened
The timeline below comes from iRhythm's SEC filing and its October 2 press release:
- June 3 to June 8, 2026: Unauthorized individuals accessed and downloaded data held in "certain third-party-hosted business applications," according to the company's forensic findings.
- June 8: iRhythm detected the activity, activated its incident response plan and brought in outside cybersecurity experts.
- June 9: A threat actor contacted the company. It claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it (8-K text quoted by ISSSource and Severity Daily).
- June 10: iRhythm decided the incident was material "in light of the volume of the potentially affected data."
- June 15: iRhythm filed a Form 8-K under Item 1.05, Material Cybersecurity Incidents. Severity Daily reports the filing is dated to the June 10 event and was signed by CEO Quentin Blackford. HIPAA Journal dates its coverage of the disclosure to June 18. Almeida Law Group says the 8-K was filed on June 10, which appears to mix up the materiality date with the filing date.
- October 2: After finishing its forensic review, iRhythm issued a press release and began notifying affected individuals for whom it holds contact information.
- October 6: Breach notices were filed with the California and Texas attorneys general. A South Carolina notice letter is also on file.
Discrepancies to note: - Discovery date: Almeida Law Group says the breach was "discovered on August 7th, 2026." That contradicts the company's own statements and SEC filing, which put detection at June 8. The company's account should take precedence. - "Ransomware": ISSSource calls the incident a ransomware attack. No company filing or statement supports that. iRhythm describes data theft followed by an extortion demand, and its spokesperson told The Record there was "no loss of service or disruption to operations." This looks like data-theft extortion without encryption, not classic ransomware. - Attribution: No group has publicly claimed the attack (The Record, Almeida Law Group). It is unknown whether iRhythm paid.
iRhythm says clinical systems, medical devices, manufacturing, distribution and patient safety were not affected. It also says it does not expect a material impact on its financial condition or results of operations (The Record, HIPAA Journal).
What Was Taken
According to iRhythm's October 2 release, the stolen data includes:
- Patient name
- Address, email address and phone number
- iRhythm patient account number
- iRhythm device serial number
- Patient insurance number
- Date of service
- Date of birth
The Record's list of categories leaves out email addresses. The company's own release and HIPAA Journal include them, so email addresses should be treated as exposed. None of the sources mention Social Security numbers, financial account data or ECG/clinical results. In its June ransom demand, however, the threat actor claimed to hold "proprietary data" and patient PHI. iRhythm has not said publicly whether corporate proprietary data was among what was taken.
Volume, by source: - 368,173 people in Texas and South Carolina combined, from state filings reported by The Record, ISSSource and HIPAA Journal. This is a floor, not a total. - California: the number of affected people has not been disclosed in these sources. - 8,179,772 people in total, claimed by Almeida Law Group (a plaintiff firm, OTHER tier). No other source supports this. For context, Almeida also says iRhythm's service has covered more than 12 million patients, so a multi-million total is plausible but not confirmed.
Severity Daily points out a tension in the company's position. iRhythm called the breach material in June specifically because of data volume, yet four months later it still has not given a count. iRhythm says it has "no evidence that any personal information has been or will be used to commit identity theft." Severity Daily reports that the notice offers no credit monitoring. The press release only recommends self-help steps such as fraud alerts, credit freezes and checking statements.
Why It Matters
The data is suited to medical fraud and targeted phishing. Name, date of birth, insurance number, date of service and device serial number together are enough to commit medical identity fraud, submit fraudulent insurance claims and run very convincing pretext calls. A message saying "this is iRhythm about your Zio patch, serial number X, worn on date Y" will look real to cardiac patients, many of whom are elderly. Email addresses in the set allow the same lures to go out at scale.
Third-party SaaS remains the weak point. The devices and clinical systems were not affected, but the business applications holding patient records were. For many healthcare companies, CRM, billing and customer-support platforms hosted by vendors hold PHI that is as sensitive as anything in the clinical environment, and these platforms often get weaker identity controls.
Extortion without encryption is now a standard playbook. Attackers do not need to disrupt operations to profit. Stealing data and threatening to leak it avoids the noise that encryption creates, and it still triggers SEC, HIPAA and state notification duties.
Disclosure delays. Notification letters went out about four months after detection. During that time, an extortion crew held data on hundreds of thousands, and possibly millions, of patients.
The Attack Technique
What is confirmed is limited:
- Initial access: The Record, ISSSource and Almeida Law Group all report that attackers got into the third-party-hosted business applications through social engineering. The company's press release does not name the access method, and the specific platforms have not been identified.
- Dwell time: About five days, June 3 to June 8, based on the forensic findings.
- Actions on objective: Bulk access and download of patient records, followed by an extortion demand the day after detection.
- Impact: Data exfiltration only. No encryption or operational disruption was reported.
The pattern (social engineering into vendor-hosted business apps, a fast bulk export, then an extortion demand with no leak-site claim) matches the SaaS data-theft campaigns that have hit many enterprises in the past two years. These usually involve help-desk or voice phishing to gain credentials, MFA enrollment or connected-app authorization. Nothing in the sources links this incident to a specific named campaign, so that link is an analyst assessment, not a confirmed attribution.
What Organizations Should Do
- Inventory PHI held in SaaS. Map which vendor-hosted applications (CRM, support desk, billing, data warehouses) store patient or customer records. Apply the same identity, logging and data-loss controls you use for core clinical systems.
- Harden help desk and identity workflows against social engineering. Require out-of-band identity verification before resetting passwords or MFA, deploy phishing-resistant MFA (FIDO2/passkeys) for SaaS admins and privileged users, and alert on new MFA device enrollments.
- Lock down OAuth and connected apps. Restrict which users can authorize third-party integrations, review existing connected-app grants, and revoke unused tokens. Rogue app authorizations are a common way to bulk-export data from SaaS.
- Detect bulk export. Turn on and forward SaaS audit logs (API usage, report exports, large queries) to your SIEM. Alert on unusual export volumes or access from new IPs or ASNs. In this case attackers had five days of access before anyone noticed.
- Prepare patients for follow-on fraud. If you hold device or service data, warn patients that you will never ask for payment or credentials by phone using device details. Publish a verified contact channel, and consider offering credit and medical identity monitoring instead of only self-help guidance.
- Pre-plan extortion response. Settle legal, SEC Item 1.05 materiality and HIPAA notification decisions ahead of time, so that confirming scope and notifying victims takes weeks, not months.
Sources: Hundreds of thousands impacted by data breach at ... | iRhythm Notifies Individuals Affected by June 2026 Hacking Incident | iRhythm Provides Update on Cybersecurity Incident | After Ransomware Attack, Medical Device Maker Alerting Victims - IS... | iRhythm declared its breach material on the volume of data in June,... | iRhythm Technologies Inc. data breach notices, Oct 6, 2026 AcidPeak | iRhythm Provides Update on Cybersecurity Incident Previously Disclo... | iRhythm Technologies Inc. Data Breach Investigation Almeida Law Group