Cardiac Monitoring Firm iRhythm Discloses Data Breach Affecting All 8.2 Million Users
iRhythm Technologies, a leading provider of cardiac arrhythmia monitoring devices, has reported a significant data breach that could potentially impact its entire user base of 8.2 million individuals.
San Francisco-based iRhythm Technologies, known for its Zio electrocardiogram monitoring devices, has disclosed a data breach that may affect all 8.2 million of its users worldwide. The company, which analyzes over 1.5 billion hours of heartbeat data, revealed the incident in a filing with the Oregon attorney general on October 6, which became public on October 16, 2026.
This disclosure confirms earlier reports that the breach was extensive, with the Oregon filing being the first official confirmation of the wide-ranging scope. iRhythm had been reluctant to provide specific numbers, stating in previous communications that the affected individual count was detailed in regulatory filings. The company's products are used by patients in the U.S. and Europe to monitor cardiac health, with data collected from wearable devices.
The breach came to light earlier this year when, in a June 10 filing to the U.S. Securities and Exchange Commission (SEC), iRhythm revealed that threat actors had demanded an undisclosed payment in exchange for not releasing stolen data. This data reportedly included proprietary information, protected health information (PHI), and other personal details of its users.
It remains unclear whether iRhythm paid the ransom demand. The company has not publicly commented on this aspect of the incident. The full scope and impact of the breach are still under assessment, and further details are expected as the investigation progresses.
This incident highlights the growing cybersecurity risks faced by healthcare technology companies, which handle vast amounts of sensitive patient data. The interconnected nature of medical devices and the cloud infrastructure they rely on present attractive targets for cybercriminals seeking to exploit vulnerabilities for financial gain or data theft.
As regulatory bodies and patients increasingly scrutinize data protection practices, companies like iRhythm face significant pressure to bolster their defenses and ensure the privacy and security of the information entrusted to them. The breach serves as a stark reminder of the critical need for robust cybersecurity measures in the healthcare sector.
Further updates on the investigation, remediation efforts, and potential impact on affected individuals are anticipated. The company's response and transparency will be crucial in rebuilding trust with its user base and stakeholders.