iRhythm data breach affected 8.2 million people, HHS filing shows

A data breach at iRhythm, a US medical technology company best known for its Zio wearable ECG heart monitor, affected about 8.2 million people, according to SecurityWeek, citing a filing with the US Department of Health and Human Services (HHS). The HHS breach portal lists the incident as affecting 8,179,772 individuals, the same figure iRhythm previously reported to the Oregon Attorney General's office.

What happened

According to SecurityWeek, the breach occurred in June 2026, when attackers stole personal information along with iRhythm account and device data. iRhythm said from the start that the data may have been taken from certain third-party-hosted business applications. The hackers attempted to extort a ransom and threatened to leak the stolen data. The report does not identify the attackers, the specific third-party applications involved, or how the attackers gained initial access.

What data was exposed

Based on iRhythm's earlier notices as summarized by SecurityWeek, the compromised data includes names, addresses and dates of birth; email addresses and phone numbers; and iRhythm account and device data, including account, serial and insurance numbers and dates of service.

Timeline

SecurityWeek reports the breach occurred in June 2026 and iRhythm disclosed it in mid-June. In early October 2026, the company began sending notification letters to affected individuals and filed notices with several state regulators and with HHS. The roughly 8.2 million figure comes from the HHS portal listing, reported in late October; SecurityWeek published its article on October 29, 2026.

Who is affected and company response

The incident affects millions of people whose health-adjacent and contact data was exposed, raising the risk of medical identity theft and fraud. iRhythm stated it "has no evidence that any personal information has been or will be used to commit identity theft" and urged affected individuals to guard against medical identity theft; SecurityWeek notes the company's notice does not mention free identity theft or credit monitoring services. iRhythm also said it had "not identified any impact" to its products, clinical or medical device systems, customer connections, manufacturing and distribution, patient safety, or its ability to meet patient needs. People who receive a notification letter should remain alert to suspicious communications referencing their medical providers or insurance and monitor accounts and benefits statements for unauthorized activity.