# iRhythm Breach May Reach 8.2 Million Zio Heart Monitor Patients

- URL: https://usa-24.com/irhythm-data-breach-zio-patients/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-19T15:13:56.255Z
- Updated: 2026-10-19T15:13:56.264Z
- Topics: Data Breach, Health Data Privacy, Medical Devices, Social Engineering, Class Action

> Attackers stole patient data from iRhythm's third-party business apps in June. State filings now point to about 8.2 million people, and notices began Oct. 2.

## Key takeaways

- Attackers accessed and downloaded data from third-party-hosted business applications used by iRhythm between June 3 and June 8, 2026.
- An Oregon attorney general listing shows 8,179,772 people, but iRhythm has not published a total itself.
- Texas and South Carolina filings so far list 368,173 affected people, with 298,647 in Texas and 69,526 in South Carolina.
- iRhythm declared the incident material in an SEC Form 8-K filed June 10, but patient notices did not start until Oct. 2.
- Exposed fields reportedly include names, dates of birth, insurance numbers and dates of service, which raises the risk of insurance fraud and phishing.

The iRhythm data breach may have exposed roughly 8.2 million people's personal and medical details, a figure that surfaced this week in state regulatory filings. The San Francisco heart-monitor maker has not published a total itself. Its only comment so far, given to [BankInfoSecurity](https://www.bankinfosecurity.com/cardiac-monitoring-firm-irhythms-hack-affects-82-million-a-33131), was that "the number of affected individuals is reflected in our required regulatory filings."

The clearest official figure comes from an Oregon attorney general listing that became public Thursday, Oct. 15. It shows 8,179,772 people, according to [HIPAA Journal](https://www.hipaajournal.com/irhythm-data-breach/). The underlying Oregon submission is dated Oct. 6, and it is the first official count at national scale.

State-level numbers are far smaller so far. Texas filings list 298,647 affected people and South Carolina lists 69,526, for a combined 368,173, according to [BeInsure](https://beinsure.com/news/irhythm-data-breach-may-affect-8mn-people/). The gap between those state totals and the national estimate is why the figure is still treated as provisional.

The scale matters because of who wears these devices. About 8 million patients use Zio monitors, according to [BankInfoSecurity's earlier report on the breach](https://www.bankinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091). If the national count holds, the breach would reach nearly the company's entire patient base. That would make it one of the largest US health-data incidents of 2026 so far.

## What the iRhythm data breach exposed and how it happened

The intrusion window was short. Attackers accessed and downloaded data from third-party-hosted business applications that iRhythm uses between June 3 and June 8, 2026, according to [Security Boulevard's weekly breach roundup](https://securityboulevard.com/2026/10/top-10-breaches-of-the-week-13/). iRhythm said social engineering gave the attackers their way in. The access ran through vendor-hosted software rather than the monitors themselves.

The timeline, drawn from filings and reporting, runs as follows:

- June 3 to June 8, 2026: attackers access and download data
- June 9: the threat actor contacts iRhythm, a day after the company detected the activity, and demands payment in exchange for not releasing the data
- June 10: iRhythm files an SEC Form 8-K declaring the incident material
- Oct. 2: patient notification letters begin
- Oct. 6: the Oregon filing with the topline count is submitted
- Oct. 15: the Oregon listing becomes public

The 8-K said the company had received the demand for an undisclosed payment. It did not say whether it paid, and that question remains unanswered.

Data fields differ by source. One account lists names, addresses, email addresses, phone numbers, iRhythm patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth. The Texas attorney general listing adds medical information and health insurance information, according to [Almeida Law Group](https://www.almeidalawgroup.com/data-breach-news/irhythm-technologies-inc-data-breach-investigation/).

iRhythm says the incident did not affect its devices, patient safety or clinical operations, and it does not expect a material financial effect. That distinction matters for patients. A stolen record is not the same as a compromised device. But the fields that leaked are the ones that fuel fraud. Birth dates, insurance numbers and service dates are enough for insurance fraud and targeted phishing, according to [Class Action U](https://classactionu.org/current-data-breaches/irhythm-technologies/).

## Why patient notices took nearly four months

iRhythm declared the incident material on June 10 but did not begin notifying patients until Oct. 2. That gap of nearly four months is the part most likely to draw questions from regulators and plaintiff lawyers, and the available filings do not explain it.

Federal tracking adds another open question. HIPAA Journal reported that the HHS Office for Civil Rights breach portal had not yet listed the incident. That portal is where federal health-breach counts are typically tracked, so a listing there would add a federal record alongside the state filings.

The delay has clear losers. Patients who heard nothing for four months could not act on the risk in the meantime. Plaintiff firms, by contrast, now have a concrete timeline to build claims around.

## Which Zio patients should expect a letter

Notices began Oct. 2, and state filings so far point to Texas and South Carolina, along with other states where filings have been made. The letter is the most direct source for whether your data was included. If you wore a Zio monitor and have not heard anything, do not assume you are clear, because the count is still moving as more filings appear.

## What to do now if you used a Zio monitor

Start with the letter and work outward from there.

- Check for an iRhythm letter. If none arrives and you know you wore a Zio monitor, check your state attorney general's breach-notice portal.
- Treat unexpected calls, texts and emails about your heart monitor, insurance or appointments as suspect. Hang up and call the number on your insurance card or the provider's official website instead.
- Ask your health insurer whether it can place a fraud alert on your member ID, and review benefit statements for services you never received.
- Request free credit reports from the three national bureaus. If your notice says Social Security numbers were involved, consider a credit freeze. None of the reports reviewed for this story list SSNs for this breach, so confirm against your letter.
- If you run a business that relies on SaaS apps, audit OAuth grants and third-party access, and require multifactor authentication for help desks, since social engineering was the entry route here.

## Lawsuits, the ransom question and what is still open

At least two law firms announced class action investigations as of Oct. 6, and no complaint had been filed by that date, according to [Almeida Law Group](https://www.almeidalawgroup.com/data-breach-news/irhythm-technologies-inc-data-breach-investigation/). Plaintiff firms are soliciting affected people, per [ClassAction.org](https://www.classaction.org/data-breach-lawsuits/irhythm-holdings-june-2026). The first filed complaint will show how plaintiffs frame the delay.

Several questions remain open. iRhythm has not published an official total. Whether it paid the extortion demand is unknown. No ransomware group has publicly claimed responsibility. It is also unclear whether the HHS portal will list the incident.

iRhythm has its own legal history. It settled a 2024 securities class action for $45 million, with a final fairness hearing set for Nov. 5, 2026, according to [KTMC](https://www.ktmc.com/irhythm-technologies-inc-settled/). That case concerns investor claims, not patient data, so it should not be confused with this breach.

For scale, the [CenterPoint Energy breach](https://usa-24.com/centerpoint-energy-data-breach-texas/) hit 1,062,060 Texans, with notices still pending. The iRhythm count is roughly eight times larger. The [Conduent data breach settlement](https://usa-24.com/conduent-data-breach-settlement/) involved an $80 million fund for 62 million people, which shows how quickly breach claims can grow in size.

Three signals will show the most in the coming weeks: whether the HHS portal lists the incident, whether more states file and move the national count away from 8.2 million, and whether a first complaint names iRhythm. For patients, the practical question is simpler: whether a letter arrives, and whether it matches the device you wore.

## Frequently asked questions

### Is my data in the iRhythm data breach?

Check for a notice from iRhythm, which began going out Oct. 2, 2026. If you wore a Zio monitor and received nothing, check your state attorney general's breach-notice portal. Filings so far cover Texas and South Carolina, plus other states where filings have been made.

### How many people does the iRhythm breach affect?

An Oregon attorney general listing shows 8,179,772 people, but iRhythm has not published a total itself. Texas and South Carolina filings list 368,173 affected people so far, with 298,647 in Texas and 69,526 in South Carolina.

### Did the iRhythm breach affect Zio monitors or patient safety?

iRhythm says the incident did not affect its devices, patient safety or clinical operations. The company also said it does not expect a material financial effect. The attackers accessed data from third-party-hosted business applications.

### Did iRhythm pay the ransom demand?

iRhythm disclosed in an SEC Form 8-K filed June 10, 2026, that it had received a demand for an undisclosed payment. It did not say whether it paid, and no ransomware group has publicly claimed responsibility.

### Was my Social Security number exposed?

None of the reports reviewed for this story list Social Security numbers for this breach. The exposed fields reportedly include names, dates of birth, insurance numbers and dates of service, so check your notice to confirm what was involved.

## Sources

1. [Cardiac Monitoring Firm iRhythm's Hack Affects 8.2 Million](https://www.bankinfosecurity.com/cardiac-monitoring-firm-irhythms-hack-affects-82-million-a-33131)
2. [Heart Monitor Firm Notifying at Least 370,000 Patients of Hack](https://www.bankinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091)
3. [iRhythm data breach may affect 8.2 mn people, hackers stole patient information](https://beinsure.com/news/irhythm-data-breach-may-affect-8mn-people/)
4. [iRhythm Data Breach Affects 8.2 Million Individuals](https://www.hipaajournal.com/irhythm-data-breach/)
5. [Top 10 Breaches of the Week](https://securityboulevard.com/2026/10/top-10-breaches-of-the-week-13/)
6. [iRhythm Technologies Inc. Data Breach Investigation](https://www.almeidalawgroup.com/data-breach-news/irhythm-technologies-inc-data-breach-investigation/)
7. [iRhythm Data Breach Affects Patient Info, Lawsuit Possible](https://www.classaction.org/data-breach-lawsuits/irhythm-holdings-june-2026)
8. [iRhythm Technologies Data Breach](https://classactionu.org/current-data-breaches/irhythm-technologies/)
9. [iRhythm Technologies, Inc. Securities Fraud Class Action (2024)](https://www.ktmc.com/irhythm-technologies-inc-settled/)