2026 iRhythm — patient PHI stolen; at least 360K in state notices
Data compromised
Patient name, address, email, phone, date of birth, iRhythm account number, device serial number, insurance number and dates of service. No payment-card or bank-account data stored, iRhythm says. Texas notice 298,647 people and South Carolina 69,526 (368,173 combined). Nationwide total unpublished and likely higher. No evidence of identity theft as of the October notice.
Technical writeup
Updated 9 Nov 2026 from iRhythm’s October patient notice and Texas plus South Carolina filings. 368,173 is the attested two-state floor, not a nationwide unique-people census.
Root cause
Social engineering against third-party-hosted business applications. Detected 8 June 2026. Access and download 3-8 June. Extortion contact 9 June. Clinical and medical-device systems were not reached. Individual notices started 2 October 2026.
References
- https://www.irhythmtech.com/us/en/who-we-are/news-events/notice-of-data-event
- https://www.sec.gov/Archives/edgar/data/1388658/000138865826000055/irtc-20260610.htm
- https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/
- https://therecord.media/irhythm-data-breach-reports
- https://www.bleepingcomputer.com/news/security/irhythm-discloses-data-breach-says-hackers-stole-patient-info/