iRhythm (Zio heart monitors): June social-engineering breach of third-party-hosted business apps exposed patient data; state filings show at least 368,000 people notified; extortion demand disclosed to SEC
iRhythm Holdings, the US maker of the Zio wearable cardiac monitor, said on 2 October 2026 that its forensic investigation into the June incident was complete and that it had begun notifying affected individuals. The company detected unauthorised access to certain third-party-hosted business applications on or around 8 June 2026, and found that data was accessed and downloaded between 3 and 8 June. In its 15 June Form 8-K, iRhythm said the access was obtained through social engineering. A threat actor contacted the company on 9 June, claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it. The exposed fields are patient name, address, email, phone, date of birth, iRhythm patient account number, device serial number, insurance number and date of service. iRhythm says it holds no financial account or payment card data, and that products, clinical and medical-device systems, manufacturing and patient safety were not affected. SecurityWeek and The Record (12 Oct) report breach notices covering 298,647 people in Texas and 69,526 in South Carolina (368,173 combined), with an additional filing in California, so the full total is not yet public. No group has publicly claimed the attack. iRhythm has not said whether it paid. Primary: iRhythm update (2 Oct, GlobeNewswire) and SEC Form 8-K (15 Jun); wire: SecurityWeek (12 Oct).
- Product
- iRhythm Holdings patient data held in third-party-hosted business applications (Zio cardiac monitoring service)
- Versions
- n/a — incident, not a product CVE
- Exploited in Australia?
- unknown
- Patch to
- Affected patients: expect follow-up phone calls or emails that quote real device serial or insurance numbers. Verify any caller through iRhythm's published call centre, not the number they give you. Health and med-tech organisations: social engineering against SaaS business apps is the entry path here, so enforce phishing-resistant MFA and helpdesk identity checks on third-party-hosted platforms that hold patient data.
Primary: iRhythm — Provides update on cybersecurity incident previously disclosed in June 2026 (GlobeNewswire, 2 Oct 2026) · Vendor: iRhythm Holdings — SEC Form 8-K Item 1.05 Material Cybersecurity Incident (filed 15 Jun 2026) · SecurityWeek — iRhythm data breach impacts at least 360,000 people (12 Oct 2026)