iRhythm Data Breach Exposes 360,000 People's Info

Post Views: 6

Medical equipment provider iRhythm has informed over 360,000 individuals that their personal data was compromised following a cyberattack.

Breach Details

The breach was detected on June 8 and involved third-party-hosted business applications that stored specific iRhythm data, according to the company. Investigation findings revealed that unauthorized actors accessed and extracted patient information from these applications between June 3 and June 8. The exposed data includes patients’ full names, residential addresses, dates of birth, and contact numbers, along with iRhythm account details such as account identifiers, device serial numbers, insurance information, and service dates.

Regulatory Filings

Regulatory filings submitted by iRhythm in multiple states indicate that at least 360,000 people were affected, with 298,647 individuals in Texas and 69,526 in South Carolina. The company acknowledges the actual number of impacted individuals may be higher.

SEC Report

In a June report to the Securities and Exchange Commission (SEC), iRhythm disclosed that attackers contacted the organization on June 9, threatening to release the stolen data online unless a ransom was paid. The company has not confirmed whether the data has been or will be used for identity theft, leading to speculation that it may have complied with the extortion demand.

Company Statement

iRhythm emphasized that the incident has not disrupted its medical devices, clinical systems, customer connectivity, manufacturing processes, or patient care capabilities. The firm also stated that the breach is unlikely to have a material effect on its financial performance or operational outcomes.

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Oracle Health Data Breach Tally Climbs to Nearly 20 Million
Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
Advantest Discloses Data Breach Months After Ransomware Attack

In Other News

US Disrupts Chinese State-Linked Ransomware Operations
Ransomware Response Expert Arrested in ShinyHunters Case
FBI Investigates Critical SonicWall Vulnerability Exploited Shortly After Disclosure
Let’s Encrypt Reduces Default Certificate Validity to 64 Days Ahead of 45-Day Transition

SecurityWeek reached out to iRhythm for further details on the breach and will update this report if additional information is provided.

People on the Move

Rapid7 has named Rik Ferguson as VP of Security Intelligence.
Cytactic has appointed Tim Brown as CSO.
Scott Simkin has joined Vega as CMO.

Expert Insights

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)

Four Cyber Threats Harboring Big Plans for the Future

AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)

Begin at the End: How to Enable Agentic Remediation

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)

“We Think the Security Control Is Working” Is No Longer Good Enough

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)

Daily Briefing Newsletter

October 14, 2026 Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline. Register

October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register