Heart-monitor maker iRhythm has told federal health regulators that 8,179,772 people were affected by a June data breach, SecurityWeek reported Thursday, more than 20 times the roughly 360,000 people counted in early state filings. The jump shows how first breach counts can badly understate exposure, a gap that matters for any company holding patient data.
What Happened
The figure appears on the breach portal run by the Office for Civil Rights at the U.S. Department of Health and Human Services (HHS), which lists health data breaches affecting 500 or more people. SecurityWeek reported that the number matches one iRhythm gave the Oregon attorney general's office.
The Primary Wire reported Oct. 9, citing The Record, that state filings then showed at least 360,000 affected people, most of them in Texas and South Carolina, and that the company had declined to give a nationwide total. SecurityWeek did not report any explanation from iRhythm for the difference.
According to SecurityWeek, attackers took data from certain business applications hosted by outside providers and then tried to extort the company by threatening to leak it. The exposed information includes names, addresses, birth dates, email addresses, phone numbers, and iRhythm account and device details such as account, serial and insurance numbers and dates of service. The company began mailing notification letters earlier this month.
iRhythm said it "has no evidence that any personal information has been or will be used to commit identity theft" and found no impact on its products or clinical and medical device systems, SecurityWeek reported. The notice urges recipients to watch for medical identity theft but does not mention free credit or identity monitoring.
Why It Matters
For boards, the iRhythm case is a reminder that the first number disclosed after a breach is rarely the last. Insurance, legal reserves and customer communications planned around an early estimate can fall well short. The incident also shows that patient data can leak through ordinary business software run by outside providers, even when a medical device maker's devices and clinical systems are untouched.
What to Watch
The HHS portal says its list covers breaches currently under investigation by the Office for Civil Rights, so a federal review is underway. Watch for class actions, state regulator inquiries, any explanation from iRhythm for the higher count and any claim by an extortion group.
