iRhythm Technologies breach exposes data of 8.2 million patients after social-engineering attack on third-party platform
iRhythm Technologies, maker of the Zio wearable ECG monitor, has had a June 2026 data breach confirmed at roughly 8.18 million individuals, according to the Oregon Attorney General breach list. This is close to its entire customer base of about 8 million patients in the US and Europe. The company first identified unauthorized access on June 8, 2026. On June 9 an unnamed threat actor claimed to have exfiltrated proprietary and patient data and demanded payment to prevent publication. iRhythm disclosed the incident as material in a Form 8-K filing with the SEC on June 18 and began sending notification letters on October 9. The incident does not yet appear on the HHS OCR breach portal.
Technical Details
- The threat actor gained access to certain business applications hosted on a third-party platform through social engineering.
- Exposed data includes names, addresses, phone numbers, email addresses, patient account numbers, device serial numbers, insurance numbers, dates of birth and dates of service.
- State-level counts include 298,647 Texas residents and 69,526 South Carolina residents.
- iRhythm reports no impact on its products, clinical or medical device systems, customer connections, manufacturing or patient safety. It does not retain financial account or payment card information.
- The filings do not say whether a ransom was paid, and the threat actor is not named.
- The article notes other recent medical device sector incidents: UFP Technologies (February 2026), Stryker (about 50 TB, March) and Medtronic (about 9 million patient records, March).
Remediation
- Affected individuals should watch for misuse of personal and insurance data, and for phishing that references their device or care.
- Organizations should harden help desk and identity verification against social engineering and review access controls and monitoring on third-party hosted business applications.
Linha do tempo
-
iRhythm Technologies breach exposes data of 8.2 million patients after social-engineering attack on third-party platform
ler a análise desta fonte ocultar
iRhythm Technologies, maker of the Zio wearable ECG monitor, has had a June 2026 data breach confirmed at roughly 8.18 million individuals, according to the Oregon Attorney General breach list. This is close to its entire customer base of about 8 million patients in the US and Europe. The company first identified unauthorized access on June 8, 2026. On June 9 an unnamed threat actor claimed to have exfiltrated proprietary and patient data and demanded payment to prevent publication. iRhythm disclosed the incident as material in a Form 8-K filing with the SEC on June 18 and began sending notification letters on October 9. The incident does not yet appear on the HHS OCR breach portal.
Technical Details
- The threat actor gained access to certain business applications hosted on a third-party platform through social engineering.
- Exposed data includes names, addresses, phone numbers, email addresses, patient account numbers, device serial numbers, insurance numbers, dates of birth and dates of service.
- State-level counts include 298,647 Texas residents and 69,526 South Carolina residents.
- iRhythm reports no impact on its products, clinical or medical device systems, customer connections, manufacturing or patient safety. It does not retain financial account or payment card information.
- The filings do not say whether a ransom was paid, and the threat actor is not named.
- The article notes other recent medical device sector incidents: UFP Technologies (February 2026), Stryker (about 50 TB, March) and Medtronic (about 9 million patient records, March).
Remediation
- Affected individuals should watch for misuse of personal and insurance data, and for phishing that references their device or care.
- Organizations should harden help desk and identity verification against social engineering and review access controls and monitoring on third-party hosted business applications.