iRhythm Says June Cyberattack Exposed Data of at Least 360,000 People
Summary
iRhythm says attackers used social engineering to access third-party business applications from June 3 to June 8 and steal personal, patient and insurance information affecting at least 360,000 people. Clinical systems and operations were not disrupted.
Key points
- iRhythm reported that at least 360,000 people were affected; state filings included 298,647 people in Texas and 69,526 in South Carolina.
- Attackers accessed third-party-hosted business applications between June 3 and June 8 after a social engineering attack.
- Stolen information included contact details, patient account and device numbers, insurance numbers, dates of service and dates of birth.
- iRhythm said the attackers downloaded data and a threat actor demanded payment to prevent public disclosure.
- The company said its clinical systems, medical devices, products and operations were not disrupted.
- iRhythm said it has no evidence the personal information has been or will be used for identity theft; no group publicly claimed responsibility.
Article Details
- Victim Organization
- iRhythm
- Incident Type
- Cyberattack involving unauthorized access to third-party-hosted business applications through social engineering and data exfiltration
- Data Types Exposed
- Names
- Addresses
- Phone numbers
- iRhythm patient account numbers
- iRhythm device serial numbers
- Patient insurance numbers
- Dates of service
- Dates of birth
- Affected Records
- At least 360,000 people; notices identified 298,647 people in Texas and 69,526 in South Carolina.
- Operational Impact
- iRhythm said clinical systems, medical devices, products, manufacturing, distribution, and operations were not affected, with no loss of service or financial impact reported.
- Ransom Or Extortion
- iRhythm reported receiving threat-actor communications demanding payment in exchange for not publicly disclosing the information.
- Claim Status
- confirmed