Short answer
iRhythm, the maker of the Zio cardiac monitor, says attackers used social engineering to reach third-party-hosted business applications between June 3 and June 8, 2026 and demanded payment not to publish the data. Patient notification letters began on October 2, and the company says payment card and financial account details were not involved.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | iRhythm Technologies |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare |
| Country | United States |
| Detected | 2026-06-08 |
| Disclosed | 2026-06-15 |
| People or records affected | At least 368,173 people in state filings (298,647 in Texas, 69,526 in South Carolina). Beinsure reports 8,179,772 nationwide from an unnamed aggregation of filings, which we could not verify. iRhythm has not published a total. |
What data was exposed
- Names, residential addresses, email addresses and phone numbers
- Dates of birth
- Patient account numbers
- Cardiac monitoring device serial numbers
- Health insurance numbers
- Dates of medical services
What happened
iRhythm Technologies, which makes the Zio wearable heart monitor, told investors on June 15, 2026 that it had been hit by a cyberattack. In its SEC filing, the company said it found “unauthorized activity” on certain third-party-hosted business applications on June 8. A threat actor contacted the company on June 9, claimed to hold sensitive information, and demanded payment to keep it private. The company said on June 10 that it considered the incident material given the volume of potentially affected data.
iRhythm says the data was obtained through social engineering, meaning someone was tricked into giving access. BleepingComputer reported that the company did not name a group and had not stated how many people were affected.
Timeline
- June 3 to June 8, 2026: data accessed and downloaded, according to later reporting.
- June 8: iRhythm detects the activity.
- June 9: extortion demand received.
- June 15: SEC filing.
- October 2: patient letters begin, per Beinsure.
The gap between June and October is the time the company spent on the forensic review to work out who was affected.
Why the number is so uncertain
October filings with state attorneys general put 298,647 people in Texas and 69,526 in South Carolina. Beinsure reports a national total of 8,179,772 from a separate aggregation of regulatory filings that it does not name. The gap probably reflects that iRhythm has not published a national total, and we could not confirm the larger figure from a primary source or a second named outlet, so treat it with caution. If you live in another state, check your own attorney general’s breach page.
How the company responded
iRhythm says its medical devices, clinical systems, manufacturing and distribution were not touched, and that it holds no payment card or financial account information. It carries cyber insurance, though it warned that coverage may not cover every loss. iRhythm also did not say whether it paid the demand.
What is still unknown
The company has not said which business applications were involved or who the attacker was. Insurance numbers and service dates are the data points most useful for medical billing fraud, so check your statements. Our guide to what to do after a data breach covers fraud alerts and freezes. Messages that copy official notices are common in phishing messages, and billing demands fall under urgent-payment scams. Our editorial policy describes how we label disputed figures.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or texts from someone who knows your heart monitor, insurer or service date, claiming to be iRhythm, a clinic or an insurer
- Medical billing scams demanding payment for 'unpaid' monitoring services
- Health insurance fraud using the stolen insurance number to bill for services you never had
- Phishing emails that copy the breach notice and ask you to log in to claim free credit monitoring
What to do if you are affected
- 01Check your mail for a letter from iRhythm and follow only the instructions in the letter, using the phone number printed there.
- 02Read every explanation of benefits from your health insurer and report services you did not receive.
- 03Ask your insurer whether it can flag or replace your member number if you see suspicious claims.
- 04Consider placing a free fraud alert or credit freeze with Equifax, Experian and TransUnion.
- 05Treat unexpected calls about a heart monitor, a bill or a refund as suspect, and hang up and call back on a number you look up yourself.
Frequently asked questions
How many people were affected by the iRhythm data breach?
It is unclear. State filings in Texas and South Carolina list 368,173 people combined, while Beinsure reports 8,179,772 nationwide from an unnamed aggregation of filings that we could not verify. iRhythm has not published its own total.
What information did the iRhythm hackers take?
iRhythm says the data includes names, addresses, email addresses, phone numbers, dates of birth, patient account numbers, device serial numbers, health insurance numbers and dates of medical service. It says payment card and financial account details were not involved.
Did iRhythm pay the ransom?
iRhythm has not said whether it paid. Its SEC filing says a threat actor contacted it on June 9, claimed to hold sensitive information and demanded payment to keep the data from being publicly disclosed.
Was my Zio heart monitor affected?
The company says the device, clinical systems, manufacturing and distribution were not affected. The breach was in third-party-hosted business applications that held patient information.
When did iRhythm start notifying patients?
According to Beinsure, patient letters began going out on October 2, 2026, after the company finished its forensic review.
Sources
- Form 8-K, iRhythm Holdings, Inc., U.S. Securities and Exchange Commission, 2026-06-15
- iRhythm discloses data breach, says hackers stole patient info, BleepingComputer, 2026-06-16
- iRhythm data breach may affect 8mn people, Beinsure, 2026-10-19
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.