More than 8 million people were impacted by a June 2026 data breach at medical equipment provider iRhythm.
The company, which specializes in wearable cardiac monitoring technology and is best known for its Zio wearable ECG monitor, disclosed the incident in mid-June.
iRhythm said right from the start that sensitive information might have been stolen from certain third-party-hosted business applications and that the hackers attempted to extort a ransom, threatening to leak the compromised data.
Earlier this month, the company started sending notification letters to the potentially affected individuals and filed notices with regulators in several states, as well as with the US Department of Health and Human Services (HHS).
The incident has now been listed on the HHS data breach portal as affecting 8,179,772 individuals, a number iRhythm previously reported to the Oregon Attorney General’s office.
Per iRhythm’s previous notices, the hackers compromised patients’ names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data (including account/serial/insurance numbers and dates of service).
“iRhythm has no evidence that any personal information has been or will be used to commit identity theft,” the company said earlier this month.
It also encouraged potentially affected individuals to protect themselves against medical identity theft and identity fraud, but its notice does not mention free identity theft or credit monitoring services.
“We have not identified any impact to our products, our clinical or medical device systems, our connections to customers, our manufacturing and distribution operations, patient safety, or our ability to meet patient needs,” the company said.
Related: Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
Related: Genesys Hack Exposes Customer Data From Internal Systems
Related: 11 Million Impacted by Capcom Data Breach
Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
