iRhythm Technologies told state regulators this month that its June data breach touched 8,179,772 people, more than twenty times the count the company had confirmed three months earlier. The Oregon Attorney General's breach list carries the new total. iRhythm has not published a comprehensive figure of its own. Filings in Texas and South Carolina earlier in October had put the known count at 368,173.
The breach started with a social engineering attack on third-party-hosted business applications, not the company's cardiac monitors. iRhythm, maker of the Zio ambulatory heart monitor, identified unauthorized access on June 8, 2026, after attackers operated inside the systems from June 3. A threat actor contacted the company the next day, claimed to hold patient and proprietary data, and demanded payment to keep it from publication. iRhythm disclosed the incident to the SEC on June 18 under Item 1.05, flagging it as material given the volume of data at risk.
The stolen fields include names, addresses, phone numbers, email addresses, dates of birth, patient account numbers, device serial numbers, insurance numbers, and dates of service. A device serial number tied to a date of service identifies which patient wore which monitor and when. That pairing survives any credit monitoring offer and has no expiration date the company controls.
iRhythm maintains that its products, clinical systems, manufacturing, and distribution saw no impact, and it reports no evidence the data has surfaced for identity theft. The company says the incident is not reasonably likely to carry a material financial effect, even as the affected count grew by more than twenty times between the first state filings and the Oregon listing. No ransomware or extortion group has publicly claimed the data. The four month gap between the SEC filing and the first patient notification letters, which began October 2, has drawn its own scrutiny.
A breach that starts in a vendor's CRM or ticketing system still lands on the device maker's desk, because the device serial number is the one detail only the manufacturer's own data can supply. Inventory every third-party application that touches a device identifier before a regulator's website does the counting instead.