iRhythm Data Breach Affects 8.2 Million Individuals
The scale of a June 2026 data breach at the wearable cardiac device manufacturer iRhythm Technologies has been confirmed. While it was clear that the cybersecurity incident involved a significant volume of patient data, the company has not previously confirmed exactly how many individuals were affected by the incident. Over the past few days, state attorneys general have been publishing details of the number of state residents affected, and the last count stood at around 368,000 individuals in Texas and South Carolina.
The incident is still not shown on the HHS’ Office for Civil Rights breach portal; however, the Oregon Attorney General has added the iRhythm data breach to its website data breach list, as involving the personal and protected health information of 8,179,772 individuals. The company’s devices are used by around 8 million individuals, which suggests that the hackers gained access to data related to its entire customer base.
October 9, 2026: iRhythm Notifies Individuals Affected by June 2026 Hacking Incident
iRhythm, a health technology company that specializes in wearable cardiac monitoring devices such as the Zio wearable ECG monitor, has started issuing notification letters to individuals affected by a June 2026 hacking and data theft incident, as reported below.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
The data review confirmed that the impacted data includes patient names, addresses, phone numbers, email addresses, patient account numbers, device serial numbers, insurance numbers, dates of birth, and dates of services. At the time of issuing notification letters, iRhythm was unaware of any misuse of patient data as a result of the incident. The company confirmed that at no point was there any impact on its products, clinical or medical device systems, customer connections, or patient safety, and the company does not believe the incident will have a material impact on the company’s financial condition or results of operations.
iRhythm said it is committed to maintaining the privacy and security of personal and protected health information in its possession, and regularly evaluates its policies, procedures, and technical controls related to data privacy and security. The company has also taken steps to mitigate the impact on individuals affected by the incident.
Regulators have been notified about the incident, although it is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected in total; however, it is clear that the incident has affected hundreds of thousands of individuals, including more than 368,000 individuals in Texas and South Carolina alone – 298,647 Texas residents and 69,526 South Carolina residents.
June 18, 2026: Heart Monitoring Device Manufacturer Discloses Cyberattack and Data Breach
iRhythm Holdings Inc., a publicly traded heart monitoring device manufacturer, has notified the U.S. Securities and Exchange Commission (SEC) about a cybersecurity incident that was first identified on June 8, 2026. According to the SEC filing, iRhythm identified unauthorized access to certain business applications that are hosted on a third-party platform. The company activated its cybersecurity incident response plan and launched an investigation to determine the nature and scope of the unauthorized activity. On June 9, 2026, one day after the unauthorized access was identified, the company received communications from a threat actor who claimed to have exfiltrated sensitive data from its applications and demanded payment to prevent the data from being publicly released.
Company Background
San Francisco, CA-based iRhythm makes cardiac monitoring devices that are used by approximately 8 million patients in the United States and Europe, and cloud-based data analytics for diagnosing and tracking patients with heart arrhythmias. The threat actor claimed to have exfiltrated proprietary data and patient data from iRhythm applications.
Scope of the Breach and Data Affected
The internal investigation confirmed that the threat actor had exfiltrated sensitive data, including personal and protected health information. While the number of individuals affected by the incident has yet to be confirmed by iRhythm, the company said in the Form 8-K filing that this was a material incident due to the volume of data potentially stolen in the attack.
Confirmed and Unaffected Systems
iRhythm has not identified any impact on its products, clinical or medical device systems, patient safety, manufacturing, distribution operations, financial reporting systems, or its ability to meet patient needs as a result of the incident.
The threat actor gained access to certain third-party hosted business applications through social engineering. The company’s medical device systems and connections to customers were not affected, and the company does not retain any individual financial account information or payment card information. iRhythm is still investigating the data breach and has yet to announce the types of data compromised in the incident.
Financial and Reputational Disclosure
The SEC filing does not state whether payment was made to the attacker or if the company is negotiating payment. While this was a material cybersecurity incident, the company does not believe it will have a material impact on its financial condition or results of operations, although the company warned that the attack could cause significant harm to the company’s brand, reputation, and patient trust in its devices. The company holds a cyber insurance policy, which may cover certain losses incurred as a result of the incident.
Other Recent Medical Device Sector Incidents
Several cyberattacks have recently been reported by medical device manufacturers, including UFP Technologies in February 2026, which involved either the theft or destruction of company data; Stryker, which involved the exfiltration of around 50 terabytes of data in March; and Medtronic experienced a major data theft incident in March, involving around 9 million patient records.
