iRhythm Breach Affects 8,179,772 People, HHS Filing Shows
Affected individuals face the risk of misuse of contact and account details, and the notification letters do not offer free credit monitoring.
Medical device maker iRhythm, known for its Zio wearable cardiac monitor, says a June 2026 cyberattack on certain third-party-hosted business applications may have exposed data on 8,179,772 people, a figure now listed on the HHS breach portal. The attackers demanded a ransom and threatened to publish the stolen records. Compromised fields include names, addresses, birth dates, email addresses, phone numbers, and account, device, insurance and service-date details. The company reports no evidence the data has been misused for identity theft, and says it has seen no effect on its products, clinical systems or patient safety. Notification letters went out earlier this month, though the letters as described do not mention free identity theft or credit monitoring.
Why it matters
For the millions of patients listed in the filing, the exposure involves identifying and contact details tied to a cardiac monitoring device, not clinical records or device function, according to the company. Because the letters as described do not mention free identity theft protection or credit monitoring, affected people must look after their own accounts and watch for unusual activity. The case also shows that data held in third-party-hosted business applications can be a route into a medical device maker's records, even when product and patient safety systems are unaffected.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.