# iRhythm Breach May Reach 8.2 Million Heart Monitor Patients

- URL: https://usa-24.com/irhythm-data-breach-zio-monitor-patients/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-16T20:02:46.940Z
- Updated: 2026-10-16T20:02:46.957Z
- Topics: Data Breach, Medical Devices, Health Data, Social Engineering, Extortion

> iRhythm's June patient-data theft may reach 8.2 million people, but the company has not confirmed that total or said whether it paid the extortion demand.

## Key takeaways

- State filings so far name 298,647 Texas residents and 69,526 South Carolina residents, or 368,173 people combined.
- The 8.2 million figure is an aggregate of regulatory filings, and iRhythm has not confirmed it as an official company total.
- Attackers accessed and downloaded patient information between June 3 and June 8, 2026, after getting into third-party hosted business applications through social engineering.
- Notifications began October 2, 2026, and the company says it has found no evidence the stolen data has been used for identity theft or fraud.
- Affected patients should check for an iRhythm letter, verify any unsolicited contact, and review credit reports and insurance statements.

Cardiac monitor maker iRhythm may have had patient data stolen from about 8.2 million people, according to a breach update published Friday, October 16. That is roughly 22 times the 370,000 people the company had been notifying since early October, and it puts a maker of heart monitors that millions of Americans use at the center of a health data case that is still taking shape.

The total is not an official company count yet. Until iRhythm confirms it in its own words, treat 8.2 million as a regulatory aggregate.

## What iRhythm says was taken and when

iRhythm is based in San Francisco and makes the Zio monitors that patients wear at home to diagnose arrhythmias. The company identified unauthorized activity on June 8, 2026, and later confirmed that attackers accessed and downloaded information between June 3 and June 8, according to [BeInsure](https://beinsure.com/news/irhythm-data-breach-may-affect-8mn-people/).

Company materials say the stolen information may include:

- Names and contact details
- Dates of birth and insurance numbers
- Service dates and device serial numbers
- Patient account identifiers

Notifications started on October 2, 2026, for people whose contact information the company has, according to [RTTNews](https://www.rttnews.com/3696264/irhythm-begins-notifying-patients-following-review-of-cybersecurity-incident.aspx). The company first disclosed the topline to the Oregon attorney general in an October 6 filing, which became public Thursday, October 15.

iRhythm says it has not identified any impact on its products, clinical or medical device systems, patient safety, manufacturing, distribution operations, financial reporting systems, or its ability to meet patient needs. The [HIPAA Journal](https://www.hipaajournal.com/irhythm-data-breach/) reports those statements from the company.

## How attackers got in through third-party business apps

The intruders got into certain third-party hosted business applications through social engineering. That means they tricked people who had access rather than exploiting a software flaw. Shared business tools are a common weak point, because one compromised set of credentials can open systems that hold data for many organizations.

The extortion angle is the most serious part of the timeline. In a filing with the U.S. Securities and Exchange Commission, iRhythm said it received demands from a threat actor for an undisclosed payment in exchange for not publicly releasing the stolen data, according to [BankInfoSecurity](https://www.bankinfosecurity.com/cardiac-monitoring-firm-irhythms-hack-affects-82-million-a-33131). The company has not said whether it paid, and the reporting reviewed for this story does not identify the threat actor.

The filing date also varies by outlet. Some coverage dates it to June 10, while another puts it on June 18. [TEISS](https://www.teiss.co.uk/news/irhythm-said-june-data-breach-exposes-data-of-over-360000-people-18304) reports that iRhythm first told the SEC about the incident in June and classified it as material because of the volume of potentially compromised data.

## Why the 8.2 million figure is not yet an official total

The 8.2 million headline comes from an aggregated national total of 8,179,772 people drawn from regulatory filings, according to [BeInsure](https://beinsure.com/news/irhythm-data-breach-may-affect-8mn-people/). iRhythm has not published a company total of its own in the reporting reviewed. In a statement to ISMG (Information Security Media Group), the company said: "the number of affected individuals is reflected in our required regulatory filings." That line points readers to the filings rather than to a single figure the company stands behind, as described in [GovInfoSecurity](https://www.govinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091).

The reporting also disagrees on whether the company has disclosed the number. The [Security Boulevard](https://securityboulevard.com/2026/10/top-10-breaches-of-the-week-13) weekly roundup says iRhythm has not published a total, while another account says the company disclosed 8.2 million in its latest update. Neither account settles the question.

The figure deserves caution for a second reason. It is roughly equal to iRhythm's entire patient base of about 8 million people in the U.S. and Europe, so an accurate count near that size would mean nearly every patient was affected. The reporting does not explain how the count was built or whether European patients are included. The HHS Office for Civil Rights breach portal had not listed the incident in the reports reviewed, so the official national tally remains unclear.

## Which states have confirmed counts so far

The clearest numbers come from state filings. Texas and South Carolina together account for 368,173 people, according to [BankInfoSecurity](https://www.bankinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091) and [BeInsure](https://beinsure.com/news/irhythm-data-breach-may-affect-8mn-people/).

| Filing | Affected people |
|---|---|
| Texas | 298,647 |
| South Carolina | 69,526 |
| Texas and South Carolina combined | 368,173 |
| National aggregate from regulatory filings | 8,179,772 |

Those two states represent about 4.5 percent of the national aggregate, which means filings from other states carry most of the total. According to [The HIPAA Guide](https://www.hipaaguide.net/irhythm-data-breach), other state attorneys general were also notified. California does not publicly disclose breach counts, so its share of the total is unknown.

## How to check whether your data was in the iRhythm breach

Start with the mail. iRhythm began notifying people on October 2, and a letter from the company is the clearest sign that your information was involved. Do not treat a call or email about the breach as proof on its own. Social-engineering attacks often follow breaches, and no source in the reporting ties phishing to this incident, so verify any contact by using a number you already trust or the support line listed in the letter.

If you received a notice, take these steps:

1. Review your credit reports for accounts you did not open.
2. Consider a fraud alert or a security freeze with the credit bureaus.
3. Monitor bank, card and account activity for changes you did not make.
4. Check insurance statements for services you did not receive.

Medical identity theft is the risk that matters most in a health data case. Stolen health records can be used to obtain care, prescriptions or insurance benefits under someone else's name. Medical records have drawn repeated attention, including the [Central Ohio primary care breach](https://usa-24.com/central-ohio-primary-care-data-breach/) that exposed data on 1.4 million people. iRhythm says it has not found evidence that the information has been used for identity theft or other fraud, but that conclusion comes from the company itself.

Phishing kits also keep circulating through criminal markets. For background on how one such supply chain was disrupted, read our coverage of the [YAM Store phishing takedown](https://usa-24.com/yam-store-phishing-takedown/).

## What comes next for iRhythm and its patients

Several questions remain open. iRhythm has not said whether it paid the extortion demand, and the threat actor has not been identified. The reporting reviewed for this story did not confirm any lawsuit or regulatory action, and it did not say whether European patients are affected. The company has reported expenses tied to the incident of about $686,000 through the quarter ending June 30, net of expected insurance recoveries, according to [GovInfoSecurity](https://www.govinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091).

Three developments will clarify the picture. The first is whether iRhythm publishes its own total and whether that total matches the 8,179,772 aggregate. The second is whether the HHS breach portal lists the incident with an official count. The third is whether more state attorneys general publish counts, since California's counts remain undisclosed. ISMG's reporting also places this breach among several recent incidents hitting medical device makers, so the sector may see more of the same social-engineering pattern in the coming months.

For patients, the practical path is clear. Check the mail, verify every contact, and keep credit monitoring in place until the official count is settled.

## Frequently asked questions

### Was my data in the iRhythm breach?

The clearest sign is a notification letter from iRhythm, which the company began sending on October 2, 2026. Notices are going to people whose contact information the company has. If you receive a call or email about the breach, verify it through a number you already trust before sharing any information.

### Is 8.2 million the official number of people affected?

Not yet. The figure is an aggregate drawn from regulatory filings, and iRhythm told ISMG that the affected count is reflected in its required regulatory filings. The Texas and South Carolina filings name 368,173 people combined, and the HHS breach portal had not listed the incident in the reports reviewed.

### What information was stolen in the iRhythm breach?

Company materials say the stolen data may include names, contact details, dates of birth, insurance numbers, service dates, device serial numbers and patient account identifiers. Attackers accessed and downloaded information between June 3 and June 8, 2026. iRhythm says it has not found evidence the information has been used for identity theft or fraud.

### Did iRhythm pay the extortion demand?

iRhythm has not said whether it paid. In a filing with the Securities and Exchange Commission, the company said it received demands from a threat actor for an undisclosed payment in exchange for not publicly releasing the stolen data. The threat actor has not been identified in the reporting reviewed for this story.

### Is there a lawsuit over the iRhythm breach?

The reporting reviewed for this story did not confirm any lawsuit or regulatory action tied to the breach. Other state attorneys general were notified, according to reporting, but California does not publicly disclose breach counts. Check state attorney general listings and court records for updates.

## Sources

1. [Cardiac Monitoring Firm iRhythm's Hack Affects 8.2 Million](https://www.bankinfosecurity.com/cardiac-monitoring-firm-irhythms-hack-affects-82-million-a-33131)
2. [Heart Monitor Firm Notifying at Least 370,000 Patients of Hack](https://www.bankinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091)
3. [iRhythm data breach may affect 8.2 mn people, hackers stole patient information](https://beinsure.com/news/irhythm-data-breach-may-affect-8mn-people/)
4. [iRhythm Notifies Individuals Affected by June 2026 Hacking Incident](https://www.hipaajournal.com/irhythm-data-breach/)
5. [Top 10 Breaches of the Week](https://securityboulevard.com/2026/10/top-10-breaches-of-the-week-13)
6. [iRhythm said June data breach exposes data of over 360,000 people](https://www.teiss.co.uk/news/irhythm-said-june-data-breach-exposes-data-of-over-360000-people-18304)
7. [Heart Monitor Firm Notifying at Least 370,000 Patients of Hack](https://www.govinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091)
8. [IRhythm Begins Notifying Patients Following Review Of Cybersecurity Incident](https://www.rttnews.com/3696264/irhythm-begins-notifying-patients-following-review-of-cybersecurity-incident.aspx)
9. [iRhythm Data Breach](https://www.hipaaguide.net/irhythm-data-breach)