HHS lists iRhythm breach at 8,179,772 affected individuals

HHS lists iRhythm Technologies Inc’s breach as affecting 8,179,772 individuals.

iRhythm’s report reached the HHS Office for Civil Rights breach portal on Oct. 3, 2026. The company discovered unauthorized entry to certain business applications run by third parties on or around June 8, 2026. People who were not authorized accessed and downloaded stored data from June 3 through June 8, 2026. No primary source names the application, the vendor, or how the attackers got in.

Patient names and addresses appeared alongside dates of birth, e-mail addresses and phone numbers. The exposed material also included iRhythm account and device data such as account numbers, serial numbers, insurance numbers and dates of service. iRhythm states it has found no evidence of identity theft involving any personal information. iRhythm also says it identified no impact to products, clinical or medical device systems, customer connections, manufacturing and distribution operations, patient safety, or the ability to meet patient needs.

Quentin Blackford, the chief executive officer, said on Aug. 6, 2026 that iRhythm contained the June incident and identified the root cause. He said products, patient care, operations and finances saw no material harm from the investigation and remediation. “While certain data was exfiltrated, our investigation and remediation actions resulted in no material impacts to our products, patient care, business operations or financial results.”

iRhythm says hackers tried to extort a ransom by threatening to release compromised data. On June 9, 2026, a threat actor told iRhythm it had obtained sensitive information and demanded payment not to publish it. In a June 10, 2026 SEC filing, the company said a threat actor wanted undisclosed payment in exchange for not releasing stolen data.

According to iRhythm’s Form 8-K, social engineering was the method used to obtain the data. One briefing says the quoted 8-K passages do not contain that claim and treats the claim as unconfirmed.

Notification letters to affected individuals went out on Oct. 2, 2026, iRhythm said. Counting from June 8, 2026, the 116-day gap to the first letters goes past the 60-day HIPAA deadline, which lands on Aug. 7, 2026. The notice does not include complimentary identity theft or credit monitoring services.

Washington’s breach list puts the affected resident count at 220,745 as of Oct. 6, 2026. iRhythm reported nearly 300,000 affected Texans and nearly 70,000 affected South Carolinians.

The company says it serves more than 8 million patients in the US and Europe and has analyzed more than 1.5 billion hours of heartbeat data. Company revenues reached $747.1 million in 2025. Costs reached about $686,000 in the second quarter ending June 30, 2026 for investigation, remediation, customer notifications and professional and consultancy expenses net of expected insurance recoveries.

The 10-Q says three putative class actions were filed in June 2026 in Northern California federal court, with two naming iRhythm Holdings Inc and one naming iRhythm Technologies Inc. The HHS OCR entry describes iRhythm Technologies Inc as a California healthcare provider, lists Hacking/IT Incident as the breach type and Network Server as the location, and records Business Associate Present: No. Medical device makers Stryker, Medtronic and Boston Scientific were hit in February, April and August respectively.

The company’s US home page carries a Notice of data event button, and the notice lists a toll-free response line. HIPAA rules call for substitute notice when contact details are missing for 10 or more people, with a conspicuous website posting for 90 days and a toll-free line running for at least 90 days. If the web posting began Oct. 2, 2026, the 90-day period runs to Dec. 31, 2026.

The company advised potentially affected people to guard against medical identity theft and identity fraud. The notice warns patients to expect phishing that quotes real details and to return calls only on independently verified numbers.