If you have ever worn a Zio heart monitor, a small patch stuck to your chest for days while it recorded every heartbeat, your personal information may now be in a hacker’s hands. iRhythm Technologies, the San Francisco company behind the device, says unauthorized individuals accessed and downloaded patient data from third-party-hosted business applications between June 3 and June 8, 2026. The company disclosed the incident to the SEC in June, but did not begin notifying individual patients until October 2, nearly four months after detection.
How the iRhythm breach happened
The attack vector was social engineering, according to iRhythm’s SEC filing. Someone tricked their way into business applications hosted by third parties, not into iRhythm’s clinical systems. The Zio devices themselves were never compromised, and the company says there was no service interruption or patient safety impact.
Then came the extortion. On June 9, 2026, iRhythm received communications from a threat actor claiming to hold sensitive information, including proprietary data and patient protected health information, and demanding payment to keep it private. The company has not disclosed whether it paid.
How many patients are affected
The confirmed number is at least 368,173: state filings list 298,647 affected individuals in Texas and 69,526 in South Carolina. But an October 6 filing with the Oregon attorney general, which became public on October 15, put the breach’s scope at 8.2 million people, according to HealthInfoSec. A separate aggregation of regulatory filings puts the figure at 8,179,772. iRhythm has not published its own national total. Asked about the figure, the company told reporters only that the number of affected individuals is reflected in its required regulatory filings. Treat 8.2 million as the filed scope, not a confirmed count.
What data was exposed
Exposed data includes patient names, addresses, email addresses, phone numbers, dates of birth, iRhythm account numbers, device serial numbers, insurance numbers, and dates of service. Two categories were not exposed: Social Security numbers and financial data such as payment cards or bank accounts, which iRhythm says it does not store on the compromised platform.
That combination is tailor-made for medical identity theft and targeted scams. Attackers holding your name, date of birth, device serial number, and insurance details can craft extremely convincing phishing calls about “device updates” or “billing issues.”
What should I do if I wore a Zio monitor?
Take these steps now if you have ever used an iRhythm Zio device, especially if you received or are waiting for a notification letter. These apply whether or not you have been formally notified, since the full affected list remains unconfirmed.
- Watch your Explanation of Benefits statements for treatments or devices you never received, the clearest sign of medical identity theft.
- Treat unsolicited calls or emails about your heart monitor, insurance, or billing as hostile until verified through iRhythm’s official channels.
- Confirm any breach notification letter came from iRhythm directly, not from a lookalike sender asking you to click a link.
- Change your iRhythm patient portal password, especially if you reuse that password on other sites.
- Request your free medical records from providers you have used and scan them for unfamiliar entries or accounts.
- As an extra precaution, consider placing a fraud alert with one credit bureau, since medical identity theft can precede financial fraud.
- Save iRhythm’s official breach notice and document every suspicious contact, in case you need evidence later.
The uncomfortable timeline
iRhythm detected the intrusion around June 8, disclosed it to the SEC that month, and started notifying individual patients on October 2. That gap between detection and patient notification is drawing scrutiny. Some coverage has raised questions about whether the delay meets HIPAA’s 60-day notification rule, though no regulator has made a finding, and the incident had not appeared in the federal breach portal as of mid-October. Note that HIPAA’s 60-day clock runs from discovery, and how a company defines the affected population also factors into compliance. The company says it has no evidence that stolen information has been used for identity theft, which is reassuring only up to a point: absence of evidence is not evidence of absence.
For patients, the practical takeaway does not depend on the final headcount. Whether the number is 368,000 or 8.2 million, the exposed data is likely the same, and the scam risk is real today. Check your statements, distrust unexpected calls about your device, and do not wait for a letter to act.
Sources: HealthInfoSec, Security Boulevard, BeInsure.
