iRhythm: June breach of Zio heart-monitor maker's business apps hit 8.2 million patients

iRhythm, the maker of the Zio wearable ECG heart monitor, says unauthorized people accessed and downloaded data from certain third-party-hosted business applications between June 3 and June 8 2026. Its June 8-K says the data was obtained through social engineering and that a threat actor demanded payment not to leak it. After its forensic review, iRhythm began notifying patients on Oct 2 2026: exposed data includes names, addresses, email addresses, phone numbers, dates of birth, iRhythm patient account and device serial numbers, insurance numbers and dates of service. iRhythm says clinical and medical device systems, payment cards and financial accounts were not involved. On Oct 29 SecurityWeek reported the HHS breach portal lists 8,179,772 affected individuals. Patients should watch for phishing and medical identity fraud, check insurance statements, and consider a credit freeze.

Why this severity: 8,179,772 patients' contact details, dates of birth, insurance numbers and device/account data stolen; extortion attempt

Started

Jun 3, 2026

• Data breach
• #Healthcare
• #Extortion
• #Social Engineering