# iRhythm: June breach of Zio heart-monitor maker's business apps hit 8.2 million patients · pwn.watch > iRhythm, the maker of the Zio wearable ECG heart monitor, says unauthorized people accessed and downloaded data from certain third-party-hosted business applications between June 3 and June 8 2026. Its June 8-K says the data was obtained through social engineering and that a threat actor demanded payment not to leak it. After its forensic review, iRhythm began notifying patients on Oct 2 2026: exposed data includes names, addresses, email addresses, phone numbers, dates of birth, iRhythm patient account and device serial numbers, insurance numbers and dates of service. iRhythm says clinical and medical device systems, payment cards and financial accounts were not involved. On Oct 29 SecurityWeek reported the HHS breach portal lists 8,179,772 affected individuals. Patients should watch for phishing and medical identity fraud, check insurance statements, and consider a credit freeze. Page: https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m · generated 2026-10-29T12:29:19.972Z ## Status - Severity: high · status: live · patch: no-fix-needed - Product: iRhythm third-party-hosted business applications (Zio patient data) - Started: 2026-06-03 - Affected: iRhythm patients (US); names, account and device numbers for customers in Japan ## Follow this incident - RSS (one item per update): https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m/feed.xml - JSON Feed: https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m.json - This file: https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m/llms.txt ## Updates (newest first) - 2026-10-29: SecurityWeek reports the HHS breach portal lists 8,179,772 affected individuals. (https://www.securityweek.com/hhs-filing-puts-irhythm-data-breach-toll-at-8-2-million/) - 2026-10-02: iRhythm finishes its forensic review and begins notifying affected patients. (https://investors.irhythmtech.com/news/news-details/2026/iRhythm-Provides-Update-on-Cybersecurity-Incident-Previously-Disclosed-in-June-2026/default.aspx) - 2026-06-08: iRhythm detects the unauthorized activity; on June 9 a threat actor claims to have the data and demands payment not to publish it. (https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm) - 2026-06-03: Unauthorized individuals begin accessing and downloading data from iRhythm's third-party-hosted business applications (through June 8). (https://investors.irhythmtech.com/news/news-details/2026/iRhythm-Provides-Update-on-Cybersecurity-Incident-Previously-Disclosed-in-June-2026/default.aspx) ## Fix brief # Security brief: iRhythm: June breach of Zio heart-monitor maker's business apps hit 8.2 million patients Source: https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m · status: live · severity: high · updated Oct 29, 2026, 11:42 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is iRhythm, the maker of the Zio wearable ECG heart monitor, says unauthorized people accessed and downloaded data from certain third-party-hosted business applications between June 3 and June 8 2026. Its June 8-K says the data was obtained through social engineering and that a threat actor demanded payment not to leak it. After its forensic review, iRhythm began notifying patients on Oct 2 2026: exposed data includes names, addresses, email addresses, phone numbers, dates of birth, iRhythm patient account and device serial numbers, insurance numbers and dates of service. iRhythm says clinical and medical device systems, payment cards and financial accounts were not involved. On Oct 29 SecurityWeek reported the HHS breach portal lists 8,179,772 affected individuals. Patients should watch for phishing and medical identity fraud, check insurance statements, and consider a credit freeze. Severity detail: 8,179,772 patients' contact details, dates of birth, insurance numbers and device/account data stolen; extortion attempt - Product: iRhythm third-party-hosted business applications (Zio patient data) ## Affected versions - iRhythm patients (US); names, account and device numbers for customers in Japan ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Latest updates - Oct 29, 2026: SecurityWeek reports the HHS breach portal lists 8,179,772 affected individuals. - Oct 2, 2026: iRhythm finishes its forensic review and begins notifying affected patients. - Jun 8, 2026: iRhythm detects the unauthorized activity; on June 9 a threat actor claims to have the data and demands payment not to publish it. - Jun 3, 2026: Unauthorized individuals begin accessing and downloading data from iRhythm's third-party-hosted business applications (through June 8). ## Advisories - [iRhythm Provides Update on Cybersecurity Incident Previously Disclosed in June 2026](https://investors.irhythmtech.com/news/news-details/2026/iRhythm-Provides-Update-on-Cybersecurity-Incident-Previously-Disclosed-in-June-2026/default.aspx) (iRhythm) - [iRhythm Holdings Form 8-K, Item 1.05 Material Cybersecurity Incidents](https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm) (U.S. SEC) - [Submitted Breach Notification Sample: iRhythm Technologies Inc.](https://oag.ca.gov/ecrime/databreach/reports/sb24-630879) (California Attorney General) - [Notice Regarding Leakage of Customer Personal Information Due to Unauthorized Access](https://www.irhythmtech.com/jp/en/notice-of-leakage-of-customer-personal-information) (iRhythm Japan) ## Write-ups & news - [HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million](https://www.securityweek.com/hhs-filing-puts-irhythm-data-breach-toll-at-8-2-million/) --- Machine-readable: https://pwn.watch/i/irhythm-zio-patient-data-breach-8-2m.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.