Summary
A filing with the U.S. Department of Health and Human Services (HHS) puts the toll of the iRhythm Technologies data breach at 8,179,772 individuals, according to SecurityWeek's October 29, 2026 report. iRhythm, the maker of the Zio wearable ECG cardiac monitor, previously reported the same figure to the Oregon Attorney General's office.
What Happened
The intrusion occurred in June 2026 and iRhythm disclosed it in mid-June. Attackers stole data from certain third-party-hosted business applications and attempted to extort the company, threatening to leak the data. In October, iRhythm began mailing notification letters and filed notices with HHS and regulators in several states.
Our earlier coverage of the incident is in iRhythm Discloses Data Breach and an interim state-filing count of roughly 360,000 in iRhythm Breach: State Filings Reveal 360,000 Affected. The HHS filing shows the real scale is more than 20 times larger.
Data Exposed
| Category | Details |
|---|---|
| Personal information | Names, addresses, dates of birth, email addresses, phone numbers |
| Account and device data | Account numbers, device serial numbers, insurance numbers, dates of service |
| Individuals affected | 8,179,772 |
iRhythm says it has no evidence the information has been or will be used for identity theft, and reports no impact on its products, clinical or medical device systems, manufacturing, or patient safety. SecurityWeek notes the notice does not mention free identity theft protection or credit monitoring.
Why It Matters
- Third-party SaaS is the common thread. Data stolen from hosted business applications, rather than core clinical systems, has been the pattern in many recent extortion campaigns.
- Insurance and device identifiers enable convincing medical-fraud and phishing attempts that reference real devices and dates of service.
- Counts grow. Initial state-level filings understated the total; HHS portal entries are often the first complete figure.
Recommended Actions
For affected individuals:
- Treat unsolicited calls, texts, or emails referencing your iRhythm device or insurance as suspect.
- Review explanation-of-benefits statements for services you did not receive.
- Consider placing a credit freeze, since credit monitoring was not mentioned as offered.
For organizations:
- Inventory third-party-hosted business applications holding patient data and enforce MFA and least-privilege access.
- Monitor SaaS audit logs for bulk exports and unusual API activity.
- Pre-plan extortion response, including regulatory notification timelines.