iRhythm Confirms Patient Data Exfiltration After Social Engineering Breach
Summary
iRhythm says attackers used social engineering to access third-party-hosted business apps and exfiltrate patient and personal data. The company received an extortion demand and says clinical and medical-device systems were unaffected.
Key points
- iRhythm said attackers accessed third-party-hosted business applications through social engineering.
- The company confirmed that certain data, including patient health and personal information, was exfiltrated.
- A threat actor demanded payment on June 9, 2026, to prevent the information from being disclosed; iRhythm did not name a group.
- iRhythm said it found no evidence that clinical or medical-device systems, patient safety, operations, or financial reporting systems were affected.
- The company launched an investigation with external cybersecurity experts and activated its incident response plan.
Article Details
- Victim Organization
- iRhythm Holdings
- Incident Type
- Data breach involving social engineering, access to third-party-hosted business applications, and confirmed data exfiltration
- Data Types Exposed
- Patient protected health information
- Other personal information
- Proprietary data
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- iRhythm launched an investigation with external cybersecurity experts and activated its cybersecurity response plan. The company reported no evidence of impact to its products, clinical or medical device systems, patient safety, manufacturing and distribution operations, or financial reporting systems.
- Ransom Or Extortion
- On June 9, 2026, iRhythm received a ransom demand from a threat actor claiming to have obtained sensitive information. The demand sought payment in exchange for not publicly disclosing it. iRhythm subsequently confirmed that certain data had been exfiltrated.
- Claim Status
- confirmed