Heart Monitor Maker iRhythm Notifies 360,000+ After a Social Engineering Breach: The Incident on One Page
Cardiac monitoring company iRhythm is notifying at least 360,000 people that patient data was stolen from third-party-hosted business applications in June. Here are the key facts and a checklist for protecting your own SaaS data.
Medical device maker iRhythm, known for the Zio heart-monitoring patch, has started telling regulators and patients that their information was stolen in a cyberattack this summer. The attackers didn’t touch the devices. They went after business applications hosted by third parties, and they got in by tricking people.
The fact sheet below is drawn from Jonathan Greig’s coverage at The Record from Recorded Future News.
The incident at a glance
- Company: iRhythm, maker of the Zio Patch, a chest-worn sensor for long-term heart monitoring and arrhythmia detection.
- People affected: at least 360,000, including 298,647 in Texas and 69,526 in South Carolina. Notices were also filed in California. The company declined to give a total.
- Attacker access: June 3 to June 8, 2026. The company dates the incident to June 8.
- Way in: a social engineering attack that reached unidentified business applications hosted by third parties.
- Data taken: names, addresses, phone numbers, dates of birth, iRhythm patient account numbers, device serial numbers, patient insurance numbers and dates of service.
- Extortion: in a June 8-K filing, iRhythm said a threat actor claimed to hold sensitive data, including patient health information, and demanded payment to keep it private. The company later confirmed data was taken from those applications.
- Claimed by: no hacking group has publicly taken credit.
- Notifications: state breach notices began this week.
What iRhythm says was not affected
- Clinical systems and medical devices.
- Products, manufacturing and distribution.
- Day-to-day operations and finances. The company reported $224.2 million in second-quarter revenue.
A spokesperson said the company responded promptly and notified people and regulators once the scope was confirmed. iRhythm says it has no evidence the information has been or will be used for identity theft.
Part of a pattern
Medical device companies have faced a wave of attacks over the past two years. Medtronic, Boston Scientific, Stryker, UFP, Masimo, Surmodics, Artivion and Zoll have all suffered incidents that exposed sensitive medical data or disrupted supply chains.
What this means for your company
This breach came through cloud business applications, not the core product, and it started with a person being fooled. The same pattern threatens any company that keeps customer data in SaaS tools.
Checklist: protecting data in third-party apps
- ☐ List every SaaS and hosted application that stores customer or employee data, with an owner for each.
- ☐ Require phishing-resistant MFA on those apps, and turn off legacy sign-in methods.
- ☐ Train staff, especially help desk and support teams, to verify unusual requests for access, password resets or MFA changes through a second channel.
- ☐ Turn on audit logging and alerts for large exports or downloads.
- ☐ Review vendor security terms and how fast they must notify you of an incident.
- ☐ Keep a breach response plan that covers state notification deadlines and extortion demands.
Need help locking down the cloud applications where your customer data actually lives? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
