2026 iRhythm Holdings — patient PHI stolen from third-party-hosted apps (SEC disclosure)

Digital cardiac-monitoring vendor iRhythm Holdings disclosed in a June 10, 2026 SEC filing that it received extortion communications on June 9 from a threat actor claiming possession of proprietary data, patient protected health information, and other personal information stored on third-party-hosted business applications. The company confirmed exfiltration from those applications on June 10, classified the incident as material given data volume, and stated attackers gained access through social engineering. iRhythm said clinical/medical device systems, manufacturing, financial reporting, and payment card data were not affected; Reuters and MassDevice reported no impact on device systems or patient safety. BleepingComputer reported the disclosure on June 16; no public victim count had been published at catalog time.