Medical equipment provider iRhythm is notifying more than 360,000 people that hackers stole their personal information.
The data breach was identified on June 8 and involved third-party-hosted business applications that stored certain iRhythm information, the company says.
During its investigation into the incident, iRhythm determined that hackers accessed and exfiltrated patient data from the affected applications between June 3 and June 8.
The compromised information includes patients’ names, addresses, email addresses, dates of birth, and phone numbers, as well as iRhythm account and device data, such as account numbers, serial numbers, insurance numbers, and dates of service.
Based on data breach notices iRhythm filed last week with regulators in several states, at least 360,000 individuals (298,647 in Texas and 69,526 in South Carolina) were affected. The total number of impacted patients is likely significantly higher.
In a June filing with the Securities and Exchange Commission (SEC), the company said the hackers contacted it on June 9, threatening to leak the stolen information online unless a ransom was paid.
Last week, iRhythm said it currently has no evidence that the stolen information “has been or will be used to commit identity theft,” which suggests that it gave in to the extortionists.
“As iRhythm previously reported, the company has not identified any impact to our products, our clinical or medical device systems, our connections to customers, our manufacturing and distribution operations, patient safety, or our ability to meet patient needs,” the company said.
Additionally, iRhythm noted that the incident is not reasonably likely to materially impact its financial condition or results of operations.
SecurityWeek has emailed iRhythm for additional information on the data breach and will update this article if the company responds.
iRhythm describes itself as a digital healthcare company that combines wearable cardiac monitoring biosensors with cloud-based data analytics to turn cardiac data into clinically actionable information.
Related: Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million
Related: Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
Related: Advantest Discloses Data Breach Months After Ransomware Attack
