Wearable cardiac monitor maker iRhythm Technologies told the Oregon Department of Justice that a June 2026 breach affected 8,179,772 people. The attackers got there without reaching a single device or clinical system, using social engineering to get into the business applications the company runs on.

HIPAA Journal reported on October 19 that iRhythm's devices are used by about 8 million patients in the U.S. and Europe, so the filed scope covers roughly the company's entire patient base.

What happened inside the business applications

In its June 10 Form 8-K, iRhythm told the SEC it found "unauthorized activity involving data maintained on certain third-party-hosted business applications" on June 8, 2026. The same filing says "the affected data was obtained through social engineering."

A threat actor contacted the company on June 9 claiming to hold proprietary data and patient PHI, and demanded payment to keep it private. iRhythm has not said whether it paid.

The forensic review later found that data was accessed and downloaded between June 3 and June 8, the day iRhythm detected the activity.

According to iRhythm's October 2 update, the stolen data includes:

  • Patient names, addresses, email addresses, and phone numbers
  • iRhythm patient account numbers and device serial numbers
  • Patient insurance numbers
  • Dates of service and dates of birth

The company also says no products, clinical or medical device systems, or connections to customers were affected. None of that infrastructure needed to fail for the breach to reach the 8,179,772 people in the Oregon filing.

Where social engineering reaches business applications

iRhythm has not described what the social engineering looked like. The HHS Health Sector Cybersecurity Coordination Center has documented one pattern used against healthcare in its help desk social engineering alert.

In that pattern, a caller posing as an employee supplied stolen identity details, claimed a broken phone, and "successfully convinced the IT help desk to enroll a new device in multi-factor authentication (MFA) to gain access to corporate resources." Once one account is enrolled on an attacker's device, every business application behind that login opens up with it.

Paubox has covered why this makes the help desk a security control point, since help desk staff can reset passwords and register new MFA methods that regular users can't.

What the 8.2 million figure does and does not confirm

The 8,179,772 figure is the scope iRhythm filed with Oregon, and iRhythm has not published a total of its own. Per-state counts confirmed so far add up to 368,173: 298,647 Texas residents, as HIPAA Journal reported from the Texas filing, and 69,526 South Carolina residents on the South Carolina Department of Consumer Affairs breach list.

As of October 19, HIPAA Journal reported that the incident still did not appear on the HHS Office for Civil Rights breach portal. Until it does, the OCR count is unknown.

How the notification timeline compares to HIPAA's outer limit

Detection on June 8 and the first patient notices on October 2 sit 116 days apart. The HIPAA Breach Notification Rule at 45 CFR 164.404 requires notice "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach."

No regulator has made any finding about iRhythm's timeline. The rule allows exceptions, including a law enforcement delay under 164.412, and nothing public says whether one applied here.

For your team, the useful comparison is internal: how long would your own forensic review of a business application take, and does your incident plan budget for it inside 60 days?

What your team can check this quarter

Start with an inventory of which business applications hold PHI and how many patients each one covers. A CRM, billing tool, or support platform that holds names, insurance numbers, and dates of service for every patient carries breach scope equal to your whole patient base.

Next, review the audit logs those applications produce. The iRhythm data left over about five days, so alerts on bulk exports and unusual downloads from a single account are worth testing against your actual log retention.

Treat MFA resets and new device enrollments as high-risk changes. HC3 recommends callbacks to the number on record and supervisor confirmation before a reset goes through.

Then look at how quickly suspicious contact reaches your security team. In Paubox's 2025 IT survey report, 95% of phishing attacks went unreported to security teams.

Where email fits

The help desk caller in the HHS alert came with stolen identity details, and phishing lures and spoofed messages from IT are one way details like those get collected, which makes email one of the channels to close. Paubox Inbound Email Security uses generative AI to flag unusual sender behavior, tone, and intent, and ExecProtect+ blocks lookalike domains and compromised accounts impersonating colleagues.

Paired with encryption for outbound PHI, that covers both directions of HIPAA compliant email for your team.