Cardiac monitor maker iRhythm may have had patient data stolen from about 8.2 million people, according to a breach update published Friday, October 16. That is roughly 22 times the 370,000 people the company had been notifying since early October, and it puts a maker of heart monitors that millions of Americans use at the center of a health data case that is still taking shape.
The total is not an official company count yet. Until iRhythm confirms it in its own words, treat 8.2 million as a regulatory aggregate.
What iRhythm says was taken and when
iRhythm is based in San Francisco and makes the Zio monitors that patients wear at home to diagnose arrhythmias. The company identified unauthorized activity on June 8, 2026, and later confirmed that attackers accessed and downloaded information between June 3 and June 8, according to BeInsure.
Company materials say the stolen information may include:
- Names and contact details
- Dates of birth and insurance numbers
- Service dates and device serial numbers
- Patient account identifiers
Notifications started on October 2, 2026, for people whose contact information the company has, according to RTTNews. The company first disclosed the topline to the Oregon attorney general in an October 6 filing, which became public Thursday, October 15.
iRhythm says it has not identified any impact on its products, clinical or medical device systems, patient safety, manufacturing, distribution operations, financial reporting systems, or its ability to meet patient needs. The HIPAA Journal reports those statements from the company.
How attackers got in through third-party business apps
The intruders got into certain third-party hosted business applications through social engineering. That means they tricked people who had access rather than exploiting a software flaw. Shared business tools are a common weak point, because one compromised set of credentials can open systems that hold data for many organizations.
The extortion angle is the most serious part of the timeline. In a filing with the U.S. Securities and Exchange Commission, iRhythm said it received demands from a threat actor for an undisclosed payment in exchange for not publicly releasing the stolen data, according to BankInfoSecurity. The company has not said whether it paid, and the reporting reviewed for this story does not identify the threat actor.
The filing date also varies by outlet. Some coverage dates it to June 10, while another puts it on June 18. TEISS reports that iRhythm first told the SEC about the incident in June and classified it as material because of the volume of potentially compromised data.
Why the 8.2 million figure is not yet an official total
The 8.2 million headline comes from an aggregated national total of 8,179,772 people drawn from regulatory filings, according to BeInsure. iRhythm has not published a company total of its own in the reporting reviewed. In a statement to ISMG (Information Security Media Group), the company said: "the number of affected individuals is reflected in our required regulatory filings." That line points readers to the filings rather than to a single figure the company stands behind, as described in GovInfoSecurity.
The reporting also disagrees on whether the company has disclosed the number. The Security Boulevard weekly roundup says iRhythm has not published a total, while another account says the company disclosed 8.2 million in its latest update. Neither account settles the question.
The figure deserves caution for a second reason. It is roughly equal to iRhythm's entire patient base of about 8 million people in the U.S. and Europe, so an accurate count near that size would mean nearly every patient was affected. The reporting does not explain how the count was built or whether European patients are included. The HHS Office for Civil Rights breach portal had not listed the incident in the reports reviewed, so the official national tally remains unclear.
Which states have confirmed counts so far
The clearest numbers come from state filings. Texas and South Carolina together account for 368,173 people, according to BankInfoSecurity and BeInsure.
| Filing | Affected people |
|---|---|
| Texas | 298,647 |
| South Carolina | 69,526 |
| Texas and South Carolina combined | 368,173 |
| National aggregate from regulatory filings | 8,179,772 |
Those two states represent about 4.5 percent of the national aggregate, which means filings from other states carry most of the total. According to The HIPAA Guide, other state attorneys general were also notified. California does not publicly disclose breach counts, so its share of the total is unknown.
How to check whether your data was in the iRhythm breach
Start with the mail. iRhythm began notifying people on October 2, and a letter from the company is the clearest sign that your information was involved. Do not treat a call or email about the breach as proof on its own. Social-engineering attacks often follow breaches, and no source in the reporting ties phishing to this incident, so verify any contact by using a number you already trust or the support line listed in the letter.
If you received a notice, take these steps:
- Review your credit reports for accounts you did not open.
- Consider a fraud alert or a security freeze with the credit bureaus.
- Monitor bank, card and account activity for changes you did not make.
- Check insurance statements for services you did not receive.
Medical identity theft is the risk that matters most in a health data case. Stolen health records can be used to obtain care, prescriptions or insurance benefits under someone else's name. Medical records have drawn repeated attention, including the Central Ohio primary care breach that exposed data on 1.4 million people. iRhythm says it has not found evidence that the information has been used for identity theft or other fraud, but that conclusion comes from the company itself.
Phishing kits also keep circulating through criminal markets. For background on how one such supply chain was disrupted, read our coverage of the YAM Store phishing takedown.
What comes next for iRhythm and its patients
Several questions remain open. iRhythm has not said whether it paid the extortion demand, and the threat actor has not been identified. The reporting reviewed for this story did not confirm any lawsuit or regulatory action, and it did not say whether European patients are affected. The company has reported expenses tied to the incident of about $686,000 through the quarter ending June 30, net of expected insurance recoveries, according to GovInfoSecurity.
Three developments will clarify the picture. The first is whether iRhythm publishes its own total and whether that total matches the 8,179,772 aggregate. The second is whether the HHS breach portal lists the incident with an official count. The third is whether more state attorneys general publish counts, since California's counts remain undisclosed. ISMG's reporting also places this breach among several recent incidents hitting medical device makers, so the sector may see more of the same social-engineering pattern in the coming months.
For patients, the practical path is clear. Check the mail, verify every contact, and keep credit monitoring in place until the official count is settled.
