iRhythm Says Hackers Stole Data Affecting at Least 360,000 People
Summary
iRhythm says hackers accessed third-party-hosted business applications and stole patient and account data between June 3 and 8. The company has reported at least 360,000 affected people and says it found no impact to its operations or patient safety.
Key points
- iRhythm identified the breach on June 8; attackers accessed and exfiltrated data from affected applications between June 3 and 8.
- Exposed information included names, contact details, dates of birth, account and device data, insurance numbers, and dates of service.
- State notices identify at least 360,000 affected people: 298,647 in Texas and 69,526 in South Carolina; the total may be higher.
- The attackers contacted iRhythm on June 9 and threatened to leak the stolen data unless a ransom was paid.
- iRhythm says it has no evidence the information has been or will be used for identity theft.
- The company reported no impact to its products, medical systems, operations, patient safety, or ability to meet patient needs.
Article Details
- Victim Organization
- iRhythm
- Incident Type
- Unauthorized access to and exfiltration of patient and account data from third-party-hosted business applications
- Data Types Exposed
- Patient names
- Addresses
- Email addresses
- Dates of birth
- Phone numbers
- Account numbers
- Device serial numbers
- Insurance numbers
- Dates of service
- Other iRhythm account and device data
- Affected Records
- At least 360,000 individuals; the source says the total is likely significantly higher.
- Operational Impact
- iRhythm reported no identified impact to its products, clinical or medical device systems, customer connections, manufacturing or distribution operations, patient safety, or ability to meet patient needs. It said the incident was not reasonably likely to materially affect its financial condition or operating results.
- Ransom Or Extortion
- iRhythm said hackers contacted the company on June 9 and threatened to leak stolen information unless a ransom was paid. The article suggests the company may have yielded to the extortionists but does not confirm whether a ransom was paid.
- Claim Status
- confirmed
Industries
HealthcareiRhythm describes itself as a digital healthcare company that combines wearable cardiac monitoring biosensors with cloud-based data analytics to turn cardiac data into clinically actionable information.Medical equipmentMedical equipment provider iRhythm is notifying more than 360,000 people that hackers stole their personal information.