- Medical technology provider iRhythm has confirmed that hackers stole patient information from third-party-hosted applications between June 3 and June 8, 2026, following a social engineering attack.
- Regulatory disclosures identify 298,647 affected individuals in Texas and 69,526 in South Carolina. A broader filing summary lists approximately 8.18 mn people affected nationwide.
- Hackers demanded payment to prevent the publication of stolen information. iRhythm reports no impact on medical devices, patient safety or clinical operations and does not expect a material financial effect.
Medical technology company iRhythm Technologies has begun notifying patients affected by a June 2026 cyberattack in which hackers accessed third-party-hosted business applications and stole personal and health-related information.
The San Francisco-based provider of wearable cardiac monitoring devices identified unauthorized activity on June 8 and subsequently confirmed that attackers accessed and downloaded information between June 3 and June 8.
State regulatory disclosures filed in October identify 298,647 affected individuals in Texas and 69,526 in South Carolina, bringing the confirmed state-specific figures to 368,173.
A separate aggregation of regulatory filings reports 8,179,772 affected people nationwide, although iRhythm has not disclosed a comprehensive total in its public notification.
What information was stolen in the iRhythm cyberattack?
According to the company’s October 2 notification, the compromised information includes patient names, residential addresses, email addresses, telephone numbers and dates of birth.
The stolen records also contain iRhythm patient account numbers, cardiac monitoring device serial numbers, health insurance numbers and dates of medical services.
The company said its investigation found that attackers obtained access through social engineering involving externally hosted business applications.
In a June filing with the Securities and Exchange Commission, iRhythm disclosed that the attackers contacted the company on June 9, claiming to possess proprietary information, protected health information and other personal records.
The threat actors demanded payment in exchange for not publicly releasing the information. iRhythm has not publicly confirmed whether a ransom was paid.
iRhythm reports no disruption to medical devices or patient safety
The company said the incident did not affect its medical devices, clinical systems, customer connections, manufacturing operations or distribution activities. Its cardiac monitoring products and related healthcare services continued operating without identified disruption.
iRhythm also stated that it has no evidence that the stolen information has been used for identity theft or other unauthorized purposes.
The company does not store individual payment card information or financial account details and said those categories were not involved in the incident.
Patients began receiving notifications on October 2, following completion of the forensic investigation and review of affected records. The company has advised individuals to monitor financial accounts, review health insurance statements and consider credit monitoring precautions to reduce potential identity theft risks.
Despite the volume of compromised information, iRhythm maintains that the incident is not reasonably likely to have a material impact on its financial condition or operating results.
Its SEC disclosure also confirms that the company maintains cybersecurity insurance, although coverage may not be sufficient to reimburse every potential loss associated with the breach.
The incident raises concerns about third-party cybersecurity in healthcare, where externally hosted applications can contain sensitive patient information even when medical devices and clinical infrastructure remain secure.
