iRhythm Breach Now Listed at 8.2 Million People on HHS Portal

Medical device maker iRhythm now appears on the federal breach portal with 8,179,772 affected people. The HHS Office for Civil Rights listing, reported by SecurityWeek, matches the figure iRhythm gave the Oregon Attorney General. That count places the June 2026 incident among the largest US health data breaches of the year so far, and it arrives after the case had surfaced mostly through state filings.

What the HHS listing means for the iRhythm data breach

The listing matters because it moves the case from scattered state paperwork onto a public federal record. Reports differ on when it went live. Paubox reported that the incident was not yet on the HHS portal as of October 19, even though the 8.2 million figure had already appeared in filings. One outlet places the listing around October 29, so the exact order of disclosures remains unclear.

How attackers got into iRhythm's business applications

iRhythm makes Zio wearable cardiac monitors. The company said a June 2026 incident involved unauthorized access to certain business applications hosted by third parties. SecurityWeek's earlier report says the hackers tried to extort a ransom by threatening to leak the data.

iRhythm told regulators that the attackers used social engineering to get into those applications, and that no clinical or medical device systems were reached. A law firm monitoring the case made the same point after the breach surfaced in an SEC Form 8-K filing, according to OffSeq Radar.

BankInfoSecurity reports that iRhythm's investigation found hackers accessed and exfiltrated patient data in a window that ran from June 3 to June 8. The timeline so far looks like this:

• June 3 to June 8, 2026: the window of unauthorized access and data theft
• June 8, 2026: iRhythm identifies the breach
• October 6, 2026: breach reports filed with several state attorneys general, including California and Oregon
• Mid-October: the 8.2 million figure begins appearing in filings
• Around October 29: outlets report the HHS portal listing

Reported stolen data includes patient names, addresses, email addresses, dates of birth and phone numbers. It also reportedly includes iRhythm account and device data, such as account, serial and insurance numbers, plus dates of service. Insurance numbers raise the stakes, because a caller who holds them can sound credible when asking for more details.

The company's statements reach the public only in paraphrase through secondary outlets. None of the reporting reviewed includes a verbatim, on-record quote from an iRhythm executive or a regulator.

Why the 8.2 million figure dwarfs the state counts

The state numbers reported so far are much smaller. SecurityWeek put the count at no fewer than 360,000 people, and BankInfoSecurity reported at least 370,000 patients being notified. Paubox's breakdown of the Texas and South Carolina filings adds up as follows.

The gap between those state tallies and the federal figure is roughly 7.8 million people. The sources do not explain it. One possible factor is the size of iRhythm's patient base. Paubox says the company's devices are used by roughly 8 million patients in the US, while BankInfoSecurity describes more than 8 million patients across its US and European customer base. The two descriptions differ, and neither source says every patient in that base was affected. A large base may explain why the total is high, but it does not confirm that the attackers reached all of those people.

The distinction matters to readers. A state filing shows that a regulator received a report, while a federal total shows how the company counts the incident. Until iRhythm explains its method, 8,179,772 is the reported figure, not a verified count of people whose data was taken.

Was my data stolen in the iRhythm breach?

Anyone who wore a Zio monitor and had account, contact or insurance details in iRhythm's systems may be among those affected. The official route is a notice letter from iRhythm. The reporting does not say when those letters will go out, and it does not confirm whether the company will offer credit monitoring.

Under the HIPAA Breach Notification Rule, covered entities generally must notify affected individuals no later than 60 calendar days after discovering a breach, a deadline Paubox quoted in its coverage. For a June 8 discovery, that 60-day mark fell in early August. The reporting does not say when individual notices were mailed, so the timeline cannot be checked against the deadline. The 60-day rule is a regulatory baseline, not a finding that iRhythm missed it.

Identity and insurance data call for a different response than saved card numbers. In a separate case, the Revolve breach exposed saved card numbers for 127,200 Texans, and the main fix there runs through card issuers rather than insurers.

iRhythm breach lawsuit and the open questions

Proposed class actions are pending in San Francisco federal court, according to Open Class Actions. ClassAction.org also flagged the possibility of litigation. Some affected patients may be eligible to join those cases, though a proposed class action is a filing by plaintiffs, not a finding of wrongdoing.

Lawsuits often follow large health breaches. A similar pattern played out after the Quest Diagnostics breach through the Quanum platform, which exposed patient records through a third-party system.

Several key facts remain unconfirmed:

• Whether the attackers sold or published the stolen data
• Whether iRhythm paid the ransom
• Which group is responsible, which none of the reporting names
• Why the federal count is so much larger than the state totals
• Whether iRhythm will offer credit monitoring and how long notification will take

What to do now if you wore a Zio monitor

If you wore a Zio monitor, or think your details were in iRhythm's systems, these steps can reduce the risk of misuse:

1. Watch for unexpected calls, texts or emails that mention a cardiac monitor or your insurance.
2. Do not share insurance numbers in response to unsolicited contact.
3. Ask your insurer to flag your account for possible misuse.
4. Check Explanation of Benefits statements for services you did not receive.
5. Consider a credit freeze, which is free at each of the three major credit bureaus.
6. Verify any notice directly with iRhythm rather than clicking links in unsolicited messages.

Three things will show whether this story grows or settles: an explanation of how iRhythm arrived at 8,179,772 people, the start of individual notice letters, and early court activity in the San Francisco cases. Each one will reveal how many patients were reached and how quickly the company moves to protect them.