iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded
Severity: high · Patch status: no-fix-needed · Since 2026-10-29
Medical device maker iRhythm disclosed a June 2026 data breach in which hackers stole personal information from third-party-hosted business applications and attempted to extort the company with threats to leak the data. An HHS OCR filing and a notice to the Oregon Attorney General put the toll at 8,179,772 individuals. Stolen data includes names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data such as account/serial/insurance numbers and dates of service. The company says there is no evidence of identity theft so far and no impact to products, clinical or medical device systems, manufacturing, or patient safety. Notification letters began going out in October 2026; no free credit monitoring was offered.
What to do
- If you or your organisation's patients may be affected, watch for iRhythm notification letters and review the company's breach notice
- Monitor for medical identity theft and insurance fraud; review explanation-of-benefits statements for unfamiliar claims
- Enforce strong, unique credentials and MFA on iRhythm and healthcare portal accounts
- Alert staff/patients to phishing that could leverage the stolen contact data
- Review third-party-hosted application security and data exposure in your own vendor relationships
Sources
All live incidents on Threat Watch
