iRhythm Breach May Reach 8.2 Million Zio Heart Monitor Patients

The iRhythm data breach may have exposed roughly 8.2 million people's personal and medical details, a figure that surfaced this week in state regulatory filings. The San Francisco heart-monitor maker has not published a total itself. Its only comment so far, given to BankInfoSecurity, was that "the number of affected individuals is reflected in our required regulatory filings."

The clearest official figure comes from an Oregon attorney general listing that became public Thursday, Oct. 15. It shows 8,179,772 people, according to HIPAA Journal. The underlying Oregon submission is dated Oct. 6, and it is the first official count at national scale.

State-level numbers are far smaller so far. Texas filings list 298,647 affected people and South Carolina lists 69,526, for a combined 368,173, according to BeInsure. The gap between those state totals and the national estimate is why the figure is still treated as provisional.

The scale matters because of who wears these devices. About 8 million patients use Zio monitors, according to BankInfoSecurity's earlier report on the breach. If the national count holds, the breach would reach nearly the company's entire patient base. That would make it one of the largest US health-data incidents of 2026 so far.

What the iRhythm data breach exposed and how it happened

The intrusion window was short. Attackers accessed and downloaded data from third-party-hosted business applications that iRhythm uses between June 3 and June 8, 2026, according to Security Boulevard's weekly breach roundup. iRhythm said social engineering gave the attackers their way in. The access ran through vendor-hosted software rather than the monitors themselves.

The timeline, drawn from filings and reporting, runs as follows:

• June 3 to June 8, 2026: attackers access and download data
• June 9: the threat actor contacts iRhythm, a day after the company detected the activity, and demands payment in exchange for not releasing the data
• June 10: iRhythm files an SEC Form 8-K declaring the incident material
• Oct. 2: patient notification letters begin
• Oct. 6: the Oregon filing with the topline count is submitted
• Oct. 15: the Oregon listing becomes public

The 8-K said the company had received the demand for an undisclosed payment. It did not say whether it paid, and that question remains unanswered.

Data fields differ by source. One account lists names, addresses, email addresses, phone numbers, iRhythm patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth. The Texas attorney general listing adds medical information and health insurance information, according to Almeida Law Group.

iRhythm says the incident did not affect its devices, patient safety or clinical operations, and it does not expect a material financial effect. That distinction matters for patients. A stolen record is not the same as a compromised device. But the fields that leaked are the ones that fuel fraud. Birth dates, insurance numbers and service dates are enough for insurance fraud and targeted phishing, according to Class Action U.

Why patient notices took nearly four months

iRhythm declared the incident material on June 10 but did not begin notifying patients until Oct. 2. That gap of nearly four months is the part most likely to draw questions from regulators and plaintiff lawyers, and the available filings do not explain it.

Federal tracking adds another open question. HIPAA Journal reported that the HHS Office for Civil Rights breach portal had not yet listed the incident. That portal is where federal health-breach counts are typically tracked, so a listing there would add a federal record alongside the state filings.

The delay has clear losers. Patients who heard nothing for four months could not act on the risk in the meantime. Plaintiff firms, by contrast, now have a concrete timeline to build claims around.

Which Zio patients should expect a letter

Notices began Oct. 2, and state filings so far point to Texas and South Carolina, along with other states where filings have been made. The letter is the most direct source for whether your data was included. If you wore a Zio monitor and have not heard anything, do not assume you are clear, because the count is still moving as more filings appear.

What to do now if you used a Zio monitor

Start with the letter and work outward from there.

• Check for an iRhythm letter. If none arrives and you know you wore a Zio monitor, check your state attorney general's breach-notice portal.
• Treat unexpected calls, texts and emails about your heart monitor, insurance or appointments as suspect. Hang up and call the number on your insurance card or the provider's official website instead.
• Ask your health insurer whether it can place a fraud alert on your member ID, and review benefit statements for services you never received.
• Request free credit reports from the three national bureaus. If your notice says Social Security numbers were involved, consider a credit freeze. None of the reports reviewed for this story list SSNs for this breach, so confirm against your letter.
• If you run a business that relies on SaaS apps, audit OAuth grants and third-party access, and require multifactor authentication for help desks, since social engineering was the entry route here.

Lawsuits, the ransom question and what is still open

At least two law firms announced class action investigations as of Oct. 6, and no complaint had been filed by that date, according to Almeida Law Group. Plaintiff firms are soliciting affected people, per ClassAction.org. The first filed complaint will show how plaintiffs frame the delay.

Several questions remain open. iRhythm has not published an official total. Whether it paid the extortion demand is unknown. No ransomware group has publicly claimed responsibility. It is also unclear whether the HHS portal will list the incident.

iRhythm has its own legal history. It settled a 2024 securities class action for $45 million, with a final fairness hearing set for Nov. 5, 2026, according to KTMC. That case concerns investor claims, not patient data, so it should not be confused with this breach.

For scale, the CenterPoint Energy breach hit 1,062,060 Texans, with notices still pending. The iRhythm count is roughly eight times larger. The Conduent data breach settlement involved an $80 million fund for 62 million people, which shows how quickly breach claims can grow in size.

Three signals will show the most in the coming weeks: whether the HHS portal lists the incident, whether more states file and move the national count away from 8.2 million, and whether a first complaint names iRhythm. For patients, the practical question is simpler: whether a letter arrives, and whether it matches the device you wore.