iRhythm Technologies breach: 8.18 million Zio patients exposed after social-engineering attack on third-party-hosted business apps
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:02; os links antigos trazem para cá.
Fontes: securityweek.com ↗ hipaajournal.com ↗
iRhythm Technologies, maker of the Zio wearable ECG monitor, has confirmed a June 2026 data breach affecting 8,179,772 individuals, now listed on the HHS breach portal (securityweek.com). The figure matches the roughly 8.18 million first seen on the Oregon Attorney General breach list, and is close to the company's entire base of about 8 million patients in the US and Europe (hipaajournal.com). iRhythm identified unauthorized access on June 8, 2026. On June 9 an unnamed threat actor claimed to have exfiltrated proprietary and patient data and demanded payment to prevent publication (hipaajournal.com). The company disclosed the incident as material in a Form 8-K filing with the SEC on June 18 and began sending notification letters on October 9 (hipaajournal.com). iRhythm reports no impact on its products, clinical or medical device systems, manufacturing, distribution or patient safety (hipaajournal.com, securityweek.com).
Detalhes técnicos
- The attacker reached certain business applications hosted on a third-party platform through social engineering (hipaajournal.com). The initial access method is not detailed in the SecurityWeek coverage (securityweek.com).
- Exposed data: names, addresses, phone numbers, email addresses, dates of birth, patient account numbers, device serial numbers, insurance numbers and dates of service (hipaajournal.com, securityweek.com).
- State-level counts: 298,647 Texas residents and 69,526 South Carolina residents (hipaajournal.com).
- The attackers threatened to leak the stolen data to extort a ransom (securityweek.com). The filings do not say whether a ransom was paid, and the actor is not named (hipaajournal.com).
- iRhythm does not retain financial account or payment card information, and customer connections were not affected (hipaajournal.com).
- Context: the article lists other recent medical device sector incidents at UFP Technologies (February 2026), Stryker (about 50 TB, March) and Medtronic (about 9 million patient records, March) (hipaajournal.com).
Remediação
- iRhythm encouraged affected individuals to protect themselves against medical identity theft and identity fraud. It says it has no evidence of identity theft resulting from the incident, and its notice does not mention free identity theft or credit monitoring services (securityweek.com).
- Affected individuals should watch for misuse of personal and insurance data and for phishing that references their device or care (hipaajournal.com).
- Organizations should harden help desk and identity verification against social engineering, and review access controls and monitoring on third-party hosted business applications (hipaajournal.com).
Relatos divergentes
- HHS listing: the earlier report said the incident did not yet appear on the HHS OCR breach portal (hipaajournal.com, October 19). The later report says it is now listed with 8,179,772 individuals (securityweek.com, October 29), which is the more recent and authoritative status.
Linha do tempo
-
iRhythm June 2026 data breach affects 8.2 million individuals, per HHS filing; hackers attempted extortion
ler a análise desta fonte ocultar
iRhythm, the maker of the Zio wearable ECG monitor, has been listed on the HHS breach portal as affecting 8,179,772 individuals from a breach disclosed in mid-June 2026. The figure matches what the company earlier reported to the Oregon Attorney General. iRhythm said from the start that sensitive data may have been stolen from certain third-party-hosted business applications, and that the attackers tried to extort a ransom by threatening to leak the data. The company began sending notification letters and filing regulator notices earlier this month. It reports no impact on its products, clinical or medical device systems, manufacturing, distribution or patient safety.
Technical Details
- Exposed data: names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data (account, serial and insurance numbers, dates of service).
- The compromise affected third-party-hosted business applications, not iRhythm's clinical or medical device systems.
- The attackers threatened to leak the stolen data. The article does not name the actor or the initial access method.
Remediation
- iRhythm encouraged affected individuals to protect themselves against medical identity theft and identity fraud.
- The company says it has no evidence of identity theft resulting from the incident. Its notice does not mention free identity theft or credit monitoring services.
-
iRhythm Technologies breach exposes data of 8.2 million patients after social-engineering attack on third-party platform
ler a análise desta fonte ocultar
iRhythm Technologies, maker of the Zio wearable ECG monitor, has had a June 2026 data breach confirmed at roughly 8.18 million individuals, according to the Oregon Attorney General breach list. This is close to its entire customer base of about 8 million patients in the US and Europe. The company first identified unauthorized access on June 8, 2026. On June 9 an unnamed threat actor claimed to have exfiltrated proprietary and patient data and demanded payment to prevent publication. iRhythm disclosed the incident as material in a Form 8-K filing with the SEC on June 18 and began sending notification letters on October 9. The incident does not yet appear on the HHS OCR breach portal.
Technical Details
- The threat actor gained access to certain business applications hosted on a third-party platform through social engineering.
- Exposed data includes names, addresses, phone numbers, email addresses, patient account numbers, device serial numbers, insurance numbers, dates of birth and dates of service.
- State-level counts include 298,647 Texas residents and 69,526 South Carolina residents.
- iRhythm reports no impact on its products, clinical or medical device systems, customer connections, manufacturing or patient safety. It does not retain financial account or payment card information.
- The filings do not say whether a ransom was paid, and the threat actor is not named.
- The article notes other recent medical device sector incidents: UFP Technologies (February 2026), Stryker (about 50 TB, March) and Medtronic (about 9 million patient records, March).
Remediation
- Affected individuals should watch for misuse of personal and insurance data, and for phishing that references their device or care.
- Organizations should harden help desk and identity verification against social engineering and review access controls and monitoring on third-party hosted business applications.