iRhythm has started sending notification letters to patients whose records attackers took from business applications hosted by a third party. Two state filings account for 368,173 people, 298,647 in Texas and 69,526 in South Carolina. The company also filed a breach notice in California without a count, declined to give a full figure, and the total has not yet appeared on the HHS Office for Civil Rights breach portal.
The unauthorized access ran from June 3 to June 8, 2026. iRhythm identified it on June 8. A threat actor contacted the company on June 9, claimed to hold sensitive data, and demanded payment in exchange for not publishing it. iRhythm told the SEC on June 18 that the incident was material given the volume of data potentially taken. The entry point was social engineering, and no group has publicly claimed the attack.
The exposed fields include names, addresses, phone numbers, email addresses, dates of birth, patient account numbers, device serial numbers, insurance numbers and dates of service. iRhythm, which makes the Zio ambulatory cardiac monitor and reported $224.2 million in second quarter revenue, says its products, medical device systems, customer connections, manufacturing and distribution were not affected and that it has no evidence the data has been used for identity theft.
The four months between the Item 1.05 filing and the first letters is the part worth studying. A device serial number next to a date of service identifies which patient wore which monitor and when, which is a durable record that no credit monitoring offer addresses. Monitoring vendors sit outside the device itself, so this exposure never had to touch firmware to become a patient privacy problem.