HHS Lists 8.18 Million People Affected by iRhythm Data Breach
Summary
HHS lists 8,179,772 people as affected by iRhythm’s June 2026 breach. The company said hackers targeted third-party business applications and attempted extortion; affected information reportedly included patient contact, birth-date, account, device, insurance, and care-
Key points
- HHS’s breach portal lists 8,179,772 affected individuals, a figure iRhythm had previously reported to Oregon’s attorney general.
- The company disclosed the incident in mid-June 2026, saying hackers targeted certain third-party-hosted business applications and attempted to extort a ransom.
- Reportedly affected information included patients’ names, addresses, birth dates, email addresses, phone numbers, and iRhythm account and device data, including insurance numbers and dates of service.
- iRhythm said it had no evidence that personal information had been or would be used for identity theft.
- The company reported no identified impact to its products, medical-device systems, customer connections, operations, patient safety, or ability to serve patients.
Article Details
- Victim Organization
- iRhythm
- Incident Type
- Data breach with an attempted ransom extortion
- Data Types Exposed
- Names
- Addresses
- Dates of birth
- Email addresses
- Phone numbers
- iRhythm account data
- Device data
- Account numbers
- Serial numbers
- Insurance numbers
- Dates of service
- Affected Records
- 8,179,772 individuals
- Operational Impact
- iRhythm said it had identified no impact to its products, clinical or medical device systems, customer connections, manufacturing or distribution operations, patient safety, or ability to meet patient needs.
- Ransom Or Extortion
- iRhythm said hackers attempted to extort a ransom and threatened to leak compromised data.
- Claim Status
- confirmed