Key facts
- The unauthorized access allowed attackers to access and exfiltrate data between June 3 and June 8, 2026.
- iRhythm said it has no evidence that the stolen data will be used for identity theft.
- On June 9, 2026, a threat actor contacted iRhythm claiming to have stolen sensitive information and demanding payment to prevent public disclosure.
- Notified individuals were given guidance on how to protect their information, including steps to guard against medical identity theft and identity fraud.
The breach affected at least 360,000 individuals, with 298,647 in Texas and 69,526 in South Carolina. On June 8, 2026, iRhythm found that unauthorized users had accessed certain third‑party hosted business applications.
iRhythm said the exposed data included patient names, addresses, email addresses, phone numbers, birthdates, account numbers, device serial numbers, insurance information, and service dates. iRhythm said the breach let attackers view and copy data from June 3 through June 8, 2026.
On June 9, 2026, a threat actor told iRhythm it had stolen sensitive data and demanded payment to prevent the data’s release. iRhythm said it has found no evidence of identity theft involving the stolen data. iRhythm stated that the breach did not affect its products, medical devices, customer links, manufacturing, distribution, patient safety or its ability to meet patient needs, and said it does not expect a material impact on its financial condition or results of operations. iRhythm has filed breach notices with regulators in multiple states and is notifying affected individuals as required by law.
Starting October 2, 2026, iRhythm began notifying affected individuals for whom it has contact information. iRhythm provided notified individuals with guidance on protecting their information, including steps to guard against medical identity theft and identity fraud. iRhythm set up a call center at 1-844-770-7175, open 8:00 a.m. to 8:00 p.m. Eastern time, Monday through Friday except major U.S. holidays, to answer questions from affected individuals.
iRhythm advised affected individuals to place a fraud alert or security freeze on their credit files, get free credit reports, and regularly review their financial account statements and credit reports for fraudulent activity. iRhythm told recipients to check any breach-related messages using official channels like its website or known phone numbers before replying.
iRhythm advised changing passwords for iRhythm-linked portals and related healthcare accounts, particularly if the same passwords were used elsewhere. iRhythm said to check health insurer portals for claims and report any suspicious activity to insurers and providers. iRhythm cautioned against sharing personal or financial information over the phone when the caller knows details that might have come from the stolen data.
Join the discussion