At least 368,173 patients in Texas and South Carolina alone were affected. Letters began going out on October 2.

 

What happened

iRhythm has begun notifying patients whose information was taken from its systems in June, BankInfoSecurity reported. The company makes the Zio heart monitor and provides cardiac monitoring to more than eight million patients in the US. Its state filings list 298,647 affected people in Texas and 69,526 in South Carolina. iRhythm has not published a national total. Exposed data includes names, addresses, email addresses, phone numbers, dates of birth, patient account numbers, insurance numbers, dates of service, and the serial numbers of patients' heart monitoring devices. The company says it does not store payment card or financial account information.

 

Going deeper

The intruders reached data held in business applications run by outside providers, not iRhythm's own clinical systems. iRhythm told the Securities and Exchange Commission that the data "was obtained through social engineering," in its June filing. Social engineering means tricking a person into handing over access, rather than breaking into a system directly. The activity ran from June 3 to June 8. iRhythm spotted it on June 8. A day later, someone contacted the company claiming to hold proprietary data and patient health information. iRhythm confirmed data had been taken and judged the incident material on June 10, because of how much data was involved.

 

What was said

iRhythm said it "has not identified any impact to its products, clinical or medical device systems, patient safety, manufacturing and distribution operations, financial reporting systems, or the Company's ability to meet patient needs," in the SEC filing. The threat actor demanded payment in exchange for not releasing the stolen data, BankInfoSecurity reported. The company says it has no evidence the information has been used for identity theft.

 

In the know

People, not software flaws, remain the most common way in. User execution and valid accounts were the two most frequent entry routes in Microsoft's incident response work over the year to June 2026, according to the Microsoft Digital Defense Report 2026. Phone-based approaches are especially effective. Microsoft found 93% of voice phishing attacks kept the victim on the line long enough for the manipulation to begin. Once attackers had one valid account, 52.2% of those intrusions went on to steal further credentials. One compromised login often leads to several more.

 

The big picture

iRhythm's data sat in third-party-hosted business applications, which is the category of system CISA built its Secure Cloud Business Applications project to address. CISA set up the project in 2022 after a run of intrusions into software-as-a-service platforms, according to the agency. It publishes secure configuration baselines for Microsoft 365 and Google Workspace. It also offers two free tools, ScubaGear and ScubaGoggles, that check an organization's settings against those baselines. The project's main audience is federal agencies, but CISA says any organization can use it. For a healthcare provider, the practical step is the same whatever platform holds the data. Know which outside applications hold patient information, check how they're configured, and decide who can reach them.

 

FAQs

Why does a device serial number matter?

It links a patient to a specific medical device. Combined with a name, insurance number, and date of service, it lets someone impersonate the company or the patient more convincingly.

 

Should iRhythm patients expect follow-up scams?

They should be cautious. The exposed data includes email addresses and phone numbers, which can be used to send messages or make calls that appear to come from iRhythm. Patients should contact the company through a number on its official website rather than one supplied in a message.

 

What is a third-party-hosted business application?

Software a company uses but doesn't run itself, such as a customer management or support platform provided by an outside vendor. The data belongs to the company, but the system sits with the provider.

 

Does a breach at a device maker affect the device?

iRhythm says its devices and clinical systems were not affected. The stolen data came from business applications, not the systems that record or analyze heart data.