For: people in the United States (and anyone else) who have worn an iRhythm Zio monitor or been registered as an iRhythm patient, and organisations that keep patient data in cloud business applications. This article is based on iRhythm Technologies' own notice and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Total number of people affected, from the company itself
- Which third-party applications were involved
- How the social engineering worked
- Whether any data was published or sold
- Whether free credit monitoring will be offered
In its October 2, 2026 notice, iRhythm says it is notifying affected people and has no evidence of identity theft misuse. It does not say when it will publish more. The count in the headline comes from the HHS listing as reported by the press, not from a company statement.
What Zio patients should do today
Do not trust links or phone numbers in unexpected messages
Names, addresses, emails, phone numbers, insurance numbers and service dates together make a message about "your Zio monitor", "an unpaid balance" or "an insurance claim" look real. This is general reasoning, not a report that such messages have been sent.
If a message asks you to log in, pay, confirm your insurance number or call back, do not use what is in the message. Open your insurer's or iRhythm's website yourself, or use the phone number on your insurance card (see What is phishing?).
Read your insurer's statements for services you do not recognize
The leaked items include an insurance number. In general, a stolen insurance number can be used to bill for care or equipment in someone else's name, which is called medical identity theft. The iRhythm notice recommends precautions against it.
Log in to your insurer's site and look at recent explanation-of-benefits statements. Report any service you did not receive to the insurer.
Consider a credit freeze and a fraud alert
The notice mentions fraud alerts, security freezes and free credit reports. In the US, a security freeze with each of the three credit bureaus is free and stops most new credit being opened in your name until you lift it.
The notice, as reported, does not mention free credit monitoring, so do not wait for an offer before acting. The US Federal Trade Commission's site IdentityTheft.gov explains the steps.
Expect your birth date and insurance number to stay usable for a long time
Unlike a password, a birth date cannot be changed. An insurance number can only be changed by the insurer. Keep watching statements and credit reports for months, not days.
No password is listed among the leaked items. If you reuse passwords across accounts, a password manager is still the practical fix.
Use only the contact points in the official notice
The company's notice gives a toll-free response line, 1-844-770-7175, open 8:00 am to 8:00 pm Eastern Time, Monday to Friday, excluding holidays. Check it against the notice on iRhythm's own website, not against a number in a message you received.
What happened (from iRhythm's notice and filing)
The sequence below is from iRhythm's notice of October 2, 2026. Items marked "reported" come from press coverage of the company's SEC filing and of the HHS listing.
June 3–8, 2026
According to the company's forensic investigation, data was accessed and downloaded from certain third-party-hosted business applications.June 8
iRhythm detected the unauthorized access (the notice says "on or around" this date) and activated its incident response plan.June 9 (reported)
A party contacted iRhythm, claimed to have taken data and demanded payment, as reported by CyberInsider and HIPAA Journal.June 15
iRhythm told the SEC. It said it did not expect a material impact on its finances, and repeated that view in October.October 2
Updated notice published; notification to affected people began for those the company has contact details for.October 29 (reported)
SecurityWeek and CyberInsider report the incident on the HHS breach portal at 8,179,772 individuals.
June 3–8, 2026
Data accessed and downloaded from third-party-hosted business applications (company)
↓
About June 8
iRhythm detects the activity (company)
↓
June 15
SEC filing
↓
October 2
Updated notice; notification of affected people begins (company)
↓
October 29
HHS listing of 8,179,772 individuals reported by SecurityWeek and CyberInsider (not a company statement)
- Company
- iRhythm Technologies, Inc. (US), maker of the Zio wearable heart monitor
- Where the data was
- Certain third-party-hosted business applications. The applications are not named
- Items taken
- Patient name; contact information (address, email address, phone number); iRhythm patient account number; iRhythm device serial number; patient insurance number; date of service; date of birth
- Classification
- The company says the data includes protected health information as defined by HIPAA
- Not stored
- The company says it does not store individual financial account or payment card information
- Cause
- The notice says unauthorized access. The press reports that the SEC filing called it social engineering, which is not in the notice. Details not disclosed
- Not affected, per the company
- Products, clinical or medical device systems, customer connections, manufacturing and distribution, patient safety
- Response
- Incident response plan activated, outside cybersecurity professionals engaged, forensic investigation completed, data reviewed to determine contents
What is known and what is not
Status as of October 30, 2026. When iRhythm publishes more, we will update the status column.
| Item | What the notice or filing says | Status |
|---|---|---|
| Period of access and download | June 3 to June 8, 2026 | Confirmed (company) |
| Detection | On or around June 8, 2026 | Confirmed (company) |
| Data items | Name, contact information, patient account number, device serial number, insurance number, date of service, date of birth | Leak confirmed (company) |
| Passwords | Not listed | Not mentioned |
| Payment card and bank account data | Company says it does not store them | Not included (company) |
| Heart-monitoring results and medical device data | Not listed; company says no impact on clinical or medical device systems | Not mentioned (clinical systems: no impact found, company) |
| Cause | The notice says unauthorized access to third-party-hosted business applications. "Social engineering" is how BleepingComputer and other outlets describe the SEC filing; it is not in the notice | Reported (not in the notice); details not disclosed |
| Number of people | iRhythm has published no total; HHS listing 8,179,772 per SecurityWeek and CyberInsider | Reported (not from the company) |
| State-level counts | 298,647 in Texas and 69,526 in South Carolina (state filings as reported by The Record; not added together) | Reported |
| Demand for payment | A party demanded payment, per press reports | Reported |
| Publication or sale of the data | Not mentioned in the notice | Not disclosed |
| Misuse of the data | Company says no evidence of identity theft misuse | No evidence found (company) |
| Free credit monitoring | Not mentioned in the notice, as reported | Not mentioned |
| Financial impact | Company says a material financial impact is not reasonably likely. Separately, BleepingComputer reports that the company determined on June 10 that the incident was material because of the volume of data involved | Company's view; June 10 determination reported |
How to read the numbers
The 8,179,772 figure is the HHS portal listing according to two outlets. We have not seen iRhythm state a total itself. The Texas and South Carolina counts are much smaller because each state filing counts only that state's residents. Do not add the state figures to each other or to the HHS figure.
What these combinations of data can be used for
In general, the following combinations can be misused as described. This does not mean it has happened in this case.
- Name + insurance number + date of birth: can be used to bill an insurer for care in someone else's name (medical identity theft), or to pass a weak identity check
- Name + contact details + service date + device serial number: lets someone write a message about "your monitor" or "your recent service" that looks like it came from the provider or a billing office
- Date of birth + address: details that many identity checks ask for, which is why a credit freeze is worth considering
For organisations that keep patient data in cloud business applications
According to the company, the data came from third-party-hosted business applications and was downloaded over several days before it was detected. How the access was obtained has not been disclosed beyond "social engineering", so this section sticks to points that any organisation with a similar setup can review. We do not assess iRhythm's measures.
List which business applications hold patient identifiers, and who can export from them
Patient names, insurance numbers and device serial numbers can sit in billing, support and scheduling tools, not only in the clinical system. List each application that holds them and who has the right to export or report on them. The notice draws a line here: the company says clinical and device systems were not affected, while the business applications were.
Alert on large exports and downloads
The company says the data was accessed and downloaded across several days (June 3 to June 8). Most business applications can log bulk exports. Send an alert to a named person when an account downloads far more records than its normal use, and make sure someone can disable that account at any hour (background: Rate limiting and abuse control).
Treat the people who reset access as part of the defence
Social engineering targets people and processes, not software. Decide in advance how staff and outside support teams verify identity before resetting a password or multi-factor method, and prefer sign-in methods that cannot be handed over by a convincing caller, such as passkeys (see the multi-factor authentication guide).
This site's view: the gap between detection and notice is part of the exposure
The company says it detected the activity in June and began notifying people in October, with the HHS count appearing later still. For patients, that is months in which their details were in someone else's hands without their knowing it. Keeping an eye on statements and credit reports for a long period is the sensible response.
Sources (public record)
The facts in this article come from the public sources below. Undisclosed methods, applications or causes are not speculated on.
- iRhythm Technologies, "Notice of Data Event" (updated notice, October 2, 2026) — irhythmtech.com
- BleepingComputer on iRhythm's SEC filing of June 15, 2026 (June 16, 2026) — bleepingcomputer.com
- SecurityWeek, "HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million" (October 29, 2026) — securityweek.com
- CyberInsider, "iRhythm's June data breach has impacted over 8.18 million people" (October 29, 2026) — cyberinsider.com
- The Record, state-level counts for Texas and South Carolina (October 9, 2026) — therecord.media
- HIPAA Journal, used only for the June 9 contact (October 19, 2026) — hipaajournal.com
The headline count rests on the press reports above of the HHS portal listing; we did not read the portal entry ourselves.
Update history
2026-10-30: First version, based on iRhythm's notice of October 2 and press reports of the SEC filing and the HHS listing (October 29). We will update this article when iRhythm publishes a total or further details.
Read next
- Another US healthcare breach with health insurance data: AdaptHealth (about 4.1 million people)
- Overview: US healthcare data breaches in 2026
- Scams after a leak: What is phishing? / Smartphone security basics
- Other 2026 incidents: Data breaches and cyberattacks in 2026