After ransomware attack, medical device maker alerting victims. Oct 9, 2026 | News By Gregory Hale San Francisco, California-based medical device maker, iRhythm Holdings, Inc., suffered a ransomware attack in June and is now informing victims of the attack. "On June 8, 2026, iRhythm Holdings, Inc. identified unauthorized activity involving data maintained on certain third-party-hosted business applications," the company said in a June filing with the Securities and Exchange Commission (SEC). "The company promptly activated its cybersecurity response plan and launched an investigation with the support of external advisors and cybersecurity experts to assess and contain the threat. "On June 9, 2026, the company received communications from a threat actor claiming to have obtained sensitive information, including proprietary data, patient protected health information and other personal information. The communications from the threat actor demanded payment in exchange for not publicly disclosing this information. "Since receipt of the communications, the company has confirmed that certain data was exfiltrated from those applications. On June 10, 2026, the company determined that the incident is material in light of the volume of the potentially affected data," the SEC notice said. The company said 298,647 people in Texas had information stolen alongside another 69,526 in South Carolina. iRhythm also filed breach notices in California. Attackers gained access. After the company completed its forensic investigation, it found attackers were on the site from June 3 through June 8. The hackers gained access to unidentified third-party-hosted business applications through a social engineering attack. On October 2 iRhythm provided an update regarding the incident. Following completion of the forensic investigation and subsequent review to determine the nature of the impacted data, the company just started notifying impacted individuals. Following the forensic investigation, iRhythm carried out a review to determine the nature of the impacted data. This review concluded the impacted data includes: Patient name; patient contact information, including address, email address, and phone number; iRhythm patient account number; iRhythm device serial number; patient insurance number; date of service; and date of birth. iRhythm said it has no evidence any personal information has been or will end up used to commit identity theft. However, beginning October 2, 2026, iRhythm began notifying impacted individuals for whom it maintains contact information. Notified individuals have been provided with instructions on best practices to protect their information. The company said out of an abundance of caution, those served by iRhythm should take steps to protect themselves. This includes protecting themselves against medical identity theft and identity fraud, placing a fraud alert/security freeze on their credit files, obtaining free credit reports, and remaining vigilant in reviewing financial account statements and credit reports for fraudulent or irregular activity on a regular basis. No impact to manufacturing. As iRhythm previously reported to the SEC, the company has not identified any impact to its products, clinical or medical device systems, connections to customers, manufacturing and distribution operations, patient safety, or ability to meet patient needs. The company still believes the incident will not have a material impact on its financial condition or results of operations. It said cybersecurity insurance that may cover certain losses associated with the incident. Although, it added, there can be no assurance that such coverage will be sufficient to cover all losses the company may incur. iRhythm manufactures its line of prescription-only ECG patch monitors and cardiac systems. iRhythm designs, develops, and commercializes wearable biosensors (such as the Zio monitor, Zio XT, and Zio AT) alongside cloud-based data analytics and its proprietary AI-driven Zio ECG Utilization Software (ZEUS). No further information was immediately available on who was behind the attack.

Medical device maker iRhythm disclosed a data breach affecting at least 360,000 people following a June cyberattack. The incident occurred on 8 June when hackers accessed third-party systems through social engineering, the company said in regulatory filings this week. The stolen information includes names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service, and birth dates. Hackers had access to company systems between 3 June and 8 June. iRhythm, known for its Zio Patch cardiac monitoring sensor, said the breach did not affect clinical systems, medical devices, or operations. The company reported receiving ransom demands but provided no evidence of identity theft. iRhythm reported $224.2 million in Q2 revenue.