iRhythm, the San Francisco-based maker of the Zio wearable heart monitor, has begun notifying at least 360,000 people that their personal and health-related information was stolen in a June cyberattack, The Record reported Friday, citing breach notices filed with state regulators this week. The case shows how patient data can leave a medical device company through third-party business software even when its clinical systems and devices are never touched.

What Happened

In a Form 8-K filed with the Securities and Exchange Commission in June, parent company iRhythm Holdings said it identified unauthorized activity on June 8 involving data kept in "certain third-party-hosted business applications," meaning software run for the company by outside providers. The next day, a threat actor contacted the company claiming to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it.

The company said it later confirmed that some data had been exfiltrated, or copied out of those applications, and on June 10 it judged the incident material "in light of the volume of the potentially affected data." The filing said the data was obtained through social engineering, the practice of tricking people into handing over access. A listing on the California attorney general's breach notification site gives the breach window as June 3 to June 8, 2026.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The Record reported that state filings show 298,647 affected people in Texas and 69,526 in South Carolina, and that a California filing did not include a count. A company spokesperson declined to give The Record a total. According to the notices as described by The Record, the exposed information includes names, addresses, phone numbers, dates of birth, insurance numbers, dates of service, and iRhythm patient account and device serial numbers.

No group has publicly claimed responsibility, The Record reported, and iRhythm has not said who was behind the attack.

Why It Matters

The iRhythm case separates two kinds of exposure that boards often treat as one. The company told investors it found no impact on its products, clinical or medical device systems, patient safety, manufacturing or financial reporting, and that it does not store payment card or financial account data. Yet its business applications held enough patient information to prompt a material-incident filing and notices to hundreds of thousands of people. Security programs at device makers that concentrate on the device and the clinical network can leave customer, billing and support tools comparatively exposed, especially to attacks that target employees rather than software flaws.

The timeline matters too. About four months passed between the June discovery and this week's notices. In its filing, the company said it was still determining the categories and volume of data involved and the individuals affected. Executives at companies holding health data should plan for a similar gap between an early securities disclosure and the point at which they can tell regulators and patients exactly who was affected.

The financial picture is less severe. iRhythm said in the 8-K that it did not consider the incident reasonably likely to have a material impact on its financial condition or results, and that it carries cybersecurity insurance that may cover certain losses, while cautioning that the coverage might not be enough. The Record noted the company reported $224.2 million in second-quarter revenue. The company also said it has no evidence that the stolen information has been or will be used for identity theft.

Context

Medical device makers have been frequent targets. The Record listed Medtronic, Boston Scientific, Stryker, Masimo and Zoll among companies in the sector that have suffered attacks in recent years that exposed sensitive data or disrupted operations. Among the risks named in iRhythm's own filing is the potential publication or misuse of the affected data by the threat actor or others.

What to Watch

  • More state filings. As notices reach other states, published counts could rise beyond the Texas and South Carolina figures; iRhythm has not released a nationwide number.
  • An amended 8-K. The company said it would amend its filing as required information is determined or becomes available.
  • The extortion demand. Neither the filing nor The Record's reporting says how iRhythm responded to the threat actor's demand, or whether the data has surfaced.
  • Legal and regulatory follow-up. The filing lists legal, regulatory, reputational and financial risks from the incident.