iRhythm Data Breach: What Happened to Your Zio Monitor Data

iRhythm Technologies, maker of the Zio wearable heart monitor, has confirmed that hackers broke into third-party-hosted business applications and stole patient data, including names, contact details, dates of birth, insurance numbers and device serial numbers. The company detected the intrusion on June 8, 2026, received a ransom demand the next day, and began formally notifying affected patients on October 2, 2026. iRhythm says the breach did not touch its Zio devices, clinical systems or patient safety, and state regulatory filings so far put the confirmed affected-individual count at just over 368,000 people — though iRhythm has not published one comprehensive nationwide total, and a wider circulating figure of roughly 8 million has not been confirmed by the company.

What happened to iRhythm

iRhythm Holdings disclosed the incident to the U.S. Securities and Exchange Commission in a Form 8-K filed under Item 1.05 (material cybersecurity incidents). According to that filing, the company identified unauthorized activity involving data maintained on certain third-party-hosted business applications on June 8, 2026. It activated its incident response plan and brought in outside forensic and legal advisors the same day.

The next day, June 9, iRhythm received a communication from a threat actor claiming to have obtained sensitive data and demanding payment in exchange for not publicly releasing it. On June 10, the company determined the incident was material "in light of the volume of the potentially affected data" and disclosed it to investors days later. iRhythm’s later notice to patients says its forensic investigation ultimately determined that data was accessed and downloaded without authorization between June 3 and June 8, 2026.

Critically, iRhythm has said the intrusion involved business applications hosted by a third party — not its own clinical infrastructure. The company’s official cybersecurity statement says the access was obtained through social engineering, a category of attack that typically targets employees or help-desk processes rather than exploiting a software vulnerability directly.

Timeline of the breach and disclosure

What data was exposed, and what wasn’t

iRhythm’s own Notice of Data Event, published on its website, lists a specific set of data types that were compromised. The company has been careful to also state what it does not hold and therefore could not have exposed, which is useful context for worried patients.

Notably absent from iRhythm’s confirmed list: Social Security numbers and driver’s license numbers, which are the data types most directly tied to new-account identity theft. Some low-quality aggregator write-ups of this breach have claimed Social Security numbers or full medical/diagnostic records were involved; those claims do not match iRhythm’s own published notice or its SEC filing, and we are not repeating them here. If you receive a notification letter, treat the data list in that letter — not a secondhand summary — as authoritative for your own situation.

iRhythm also says it found "no evidence that any personal information has been or will be used to commit identity theft," though that is a statement about what it has observed so far rather than a guarantee.

How many people are affected

This is the part of the story that remains genuinely unresolved, and it’s worth being precise about it. iRhythm has not published one nationwide total number of affected individuals. What exists instead are breach notification filings the company has made with individual state attorneys general, which only report counts for residents of that specific state:

• Texas: 298,647 individuals
• South Carolina: 69,526 individuals

Added together, that’s at least 368,173 confirmed affected people across just those two states — and security-trade outlets covering the state filings, including SecurityWeek, have noted the true national number "is likely significantly higher" once filings from additional states are accounted for. iRhythm serves patients across all 50 U.S. states as well as parts of Europe, so additional state notices may still surface counts this article doesn’t yet reflect.

Separately, some secondary trackers and aggregator sites have circulated a much larger figure — in the range of 8 million affected records — sometimes citing iRhythm’s total patient base rather than a confirmed breach count. That nationwide figure has not been confirmed by iRhythm, does not appear in its SEC filing or its own Notice of Data Event, and should be treated as an unverified estimate, not a company-reported fact. We’re flagging it here only because readers are likely to encounter it elsewhere, not because we can stand behind it.

Was this a ransomware or extortion attack

Based on iRhythm’s SEC filing, this was an extortion attempt rather than a confirmed ransomware (file-encryption) incident. The attacker contacted iRhythm directly after exfiltrating data and threatened to publicly release it unless paid — a tactic sometimes called "pure extortion" because no systems are locked or encrypted, only data is held hostage. iRhythm’s filing does not state whether a ransom was paid or how much was demanded, and as of the company’s most recent public statements, no identified ransomware or extortion group has publicly taken credit for the attack or leaked the stolen data.

The entry point described by iRhythm — social engineering against third-party-hosted business applications — is an increasingly common pattern in 2026 healthcare breaches, where attackers target vendor help desks, single sign-on resets, or employee credentials rather than attacking hospital or device networks directly.

Is your Zio heart monitor itself safe to use

Yes, according to iRhythm. Across both its SEC filing and its public cybersecurity statement, the company has consistently said it identified no impact to its products, its clinical or medical device systems, its connections to customers, its manufacturing and distribution operations, or patient safety. In plain terms: the breach affected business records about patients, not the Zio patch, its monitoring algorithms, or the diagnostic data pipeline a patient’s cardiologist relies on.

That distinction matters for anyone currently wearing a Zio monitor or waiting on a diagnostic report: there is no indication this incident affects whether your device collects or transmits your heart-rhythm data correctly, or that your in-progress monitoring results were tampered with.

What iRhythm is doing now

Per its own notice, iRhythm has:

• Engaged outside forensic and legal experts to investigate the scope of the incident.
• Reviewed and is modifying its internal security practices and controls for the affected third-party applications.
• Filed required breach notifications with state attorneys general and begun mailing letters to patients for whom it has contact information, starting October 2, 2026.
• Set up a dedicated call center at 1-844-770-7175 (8:00 a.m. to 8:00 p.m. ET, Monday through Friday, excluding holidays) for patients with questions.

Notably, iRhythm’s published notice does not mention a complimentary credit monitoring or identity-protection subscription for affected patients, which many breached companies offer as a standard remediation step. If that changes, or if your letter mentions an enrollment code or offer, follow the instructions in your specific letter rather than assuming a blanket offer applies.

What affected patients should do right now

Because Social Security numbers do not appear on iRhythm’s confirmed list of exposed data, the most useful protections here are less about new-account fraud and more about insurance misuse and phishing. Based on iRhythm’s own guidance plus standard practice for this category of breach:

• Watch for phishing and "smishing." Scammers often use real breach events to craft convincing follow-up emails or texts claiming to be from the breached company, a "credit monitoring" vendor, or even a health insurer. Don’t click links in unsolicited messages about this breach — go directly to iRhythm’s own site or call the number on your insurance card. Our guide to password managers is also a good moment to tighten up reused passwords tied to your email or health portal accounts, since a stolen email address is often the first domino in a follow-on phishing campaign.
• Review insurance explanation-of-benefits (EOB) statements. Because insurance numbers and dates of service were exposed, the realistic risk here leans toward medical insurance fraud (someone billing services in your name) rather than new credit cards. iRhythm’s notice specifically recommends asking your insurer for a year-to-date accounting of benefits paid on your behalf and flagging anything unfamiliar.
• Consider a fraud alert or credit freeze. Even without a confirmed Social Security number exposure, a free one-year fraud alert with one of the three major credit bureaus (Equifax, Experian, TransUnion) costs nothing and that bureau is required to notify the other two. A full security freeze is free and more restrictive, but will need to be lifted with a PIN before you apply for new credit.
• Pull your free credit reports. All three bureaus offer free reports at annualcreditreport.com or by calling 1-877-322-8228; scan for accounts or inquiries you don’t recognize.
• Call iRhythm’s dedicated line if you have questions about your specific notification letter: 1-844-770-7175, weekdays 8 a.m. to 8 p.m. ET.
• Report suspected misuse. If you do spot fraud, file a report with your local police and with the FTC at ftc.gov/idtheft or 1-877-438-4338.

This breach arrives in a year that has already seen other large organizations disclose significant intrusions, including grocery chains hit through a cyberattack affecting Food Lion and Stop & Shop, and enterprise software exposed through issues like the Ivanti Connect Secure zero-day that pushed federal agencies onto a CISA-mandated patch deadline. The common thread across most of 2026’s bigger breaches, including iRhythm’s, is that attackers increasingly go after the business software and vendor relationships surrounding a product, not the product itself.

Frequently asked questions

Is my Zio monitor or its data transmission affected? No. iRhythm says it has identified no impact to its products, clinical or medical device systems, or patient safety.

Were Social Security numbers stolen? Not according to iRhythm’s own published Notice of Data Event, which lists name, address, email, phone number, date of birth, account number, device serial number, insurance number and date of service — and does not list Social Security numbers.

How many people were affected nationwide? iRhythm has not published a single nationwide total. State filings confirm at least 368,173 people in Texas and South Carolina combined; the true national number is expected to be higher once additional state notices are accounted for, but no comprehensive figure has been confirmed by the company.

Is the circulating 8 million figure accurate? It has not been confirmed by iRhythm and does not appear in its SEC filing or patient notice. Treat it as an unverified third-party estimate.

Did iRhythm pay the ransom? The company has not said publicly whether it paid, and no extortion or ransomware group has publicly claimed responsibility or leaked the data as of this writing.

Is iRhythm offering free credit monitoring? Its published notice does not mention a credit monitoring offer. Check your individual notification letter for any specific offer, since it may contain details not reflected in the general public notice.

What’s next

Expect iRhythm to amend its SEC filing as more information becomes available — the company explicitly reserved the right to do so in its original 8-K — and expect additional state attorney general filings to surface as mailed notifications reach more residents outside Texas and South Carolina. Until a nationwide total is confirmed, treat any specific headline number you see elsewhere with caution. For now, the most reliable individual guidance is the letter iRhythm mails directly to affected patients and the company’s own Notice of Data Event page, which it says it will keep updated as the investigation progresses.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage