Breaches

iRhythm heart monitor breach reaches at least 360,000 patients

Zio heart patch maker iRhythm is notifying at least 360,000 patients after a June social engineering attack on hosted business apps.

Padlock graphic with the headline iRhythm breach hits 360,000 heart patients

Cardiac monitoring firm iRhythm, maker of the Zio heart patch, has started telling patients their details were stolen in a June intrusion, and state filings published last week show at least 360,000 people affected. The attackers never touched a medical device: they talked their way into hosted business applications and walked out with patient records.

What happened

iRhythm Technologies, the San Francisco company behind the Zio wearable ECG monitor, began sending breach notification letters to patients, with the sample letter filed in California dated 2 October 2026. Filings made with US state regulators last week give the first real sense of scale. According to The Record, 298,647 people in Texas and 69,526 in South Carolina were affected, more than 368,000 between them, with a further notice lodged in California. The company has declined to give a total, so the total of at least 360,000 cited by The Record should be read as a floor rather than a final figure.

This is not a new intrusion. iRhythm first disclosed the incident in a Form 8-K filed with the US Securities and Exchange Commission on 15 June. That filing says the company spotted unauthorised activity on 8 June, and that on 9 June it received messages from a threat actor claiming to hold proprietary data and patient health information and demanding payment to keep it private. By 10 June the company had concluded that the incident was material “in light of the volume of the potentially affected data”. What is new is that the forensic review has finished, letters are going out and the numbers are starting to surface in regulator filings.

According to The Record, no ransomware or extortion group has publicly claimed responsibility.

The technical picture

iRhythm has said little, but its 8-K, its California sample letter and its statements are consistent. The attackers got in through social engineering and reached business applications hosted by a third party. The company has not named the platform. Its forensic investigation found that data was accessed and downloaded between 3 and 8 June 2026, a window of around six days before detection.

According to the letter, the stolen fields cover names, dates of birth, postal and email addresses, phone numbers, insurance numbers, iRhythm account and device serial numbers, and dates of service. iRhythm says clinical systems, medical devices, customer connections, manufacturing and distribution were unaffected, and that it does not hold payment card or financial account details. It also says it has no evidence that the information has been or will be used for identity theft.

That last point needs some care. On paper the dataset is not clinical, but a Zio account number, a device serial and a date of service together show that a named person was being monitored for a possible heart rhythm problem on a known date. Under UK GDPR, data that reveals information about a person’s health status is likely to count as special category data, whatever the field labels say. It is ideal material for a convincing scam call.

Timeline of the iRhythm data breach from the June intrusion to October patient notifications

Why it matters for UK organisations

Zio is not just a US product. In December 2020 NICE recommended Zio XT for people with suspected cardiac arrhythmias who need ECG monitoring for longer than 24 hours; iRhythm says it was the first technology through a NICE digital health pilot. That guidance, originally MTG52, has since been reissued as HealthTech guidance 562. iRhythm also says it won funding through a UK government AI award for health and care to evaluate the service at NHS sites, and it runs a UK patient support line. HIPAA Journal reports that iRhythm’s devices are used by around 8 million patients across the United States and Europe.

To be clear: none of the filings or reports seen so far says that UK or European patients are among those affected. Every count published so far comes from US state notifications, and UK patient data may sit in entirely separate systems. Even so, NHS trusts, integrated care boards and private cardiology providers that use Zio are data controllers for their patients. They should be asking iRhythm directly, in writing, whether any UK personal data was held in the applications involved, rather than assuming it was not.

For most readers the wider lesson matters more: a medical technology supplier lost patient data without its regulated device estate being touched. The weak point was the ordinary hosted business tooling around it.

Expert view

In my experience, organisations tend to spend their assurance effort where the regulator looks hardest. For a device maker that means firmware, clinical software and manufacturing. The SaaS estate that holds patient contact details, insurance numbers and service histories often gets far less scrutiny, and it is usually guarded by single sign-on, a helpdesk and a handful of administrators who can be talked into a password or MFA reset.

When we run social engineering exercises against support teams, the technical control is rarely what fails. What fails is the reset process, which was designed for convenience. A caller with a plausible story and a little personal information can often get credentials or a new MFA device enrolled, and from there a cloud application looks like legitimate use. A six-day gap before detection, as here, is not unusual: bulk exports from SaaS platforms are rarely logged anywhere the security team watches.

I would also question any reassurance based on no evidence of misuse. The extortion demand on 9 June tells you what the attacker thought the data was worth. Health-adjacent records have a long shelf life for targeted fraud.

What to do now

  1. Ask your suppliers. If you use Zio or any other remote monitoring service, ask the supplier formally whether UK personal data was in scope, where it is hosted and which sub-processors hold it. Keep the response for your UK GDPR Article 28 and Data Security and Protection Toolkit records.
  2. Harden helpdesk and identity recovery. Require call-back to a known number or manager approval for password and MFA resets on privileged and SaaS administrator accounts. This maps to the Cyber Essentials user access control requirements.
  3. Move to phishing-resistant MFA (FIDO2 or passkeys) for access to SaaS platforms that hold patient or customer data, and stop new devices from being enrolled without verification.
  4. Turn on and monitor SaaS audit logs. Alert on bulk exports, report generation and unusual API volumes, and send those events to your SIEM rather than leaving them in the vendor console.
  5. Review OAuth and third-party app access to your business platforms, and remove integrations and accounts you no longer need, in line with Cyber Essentials secure configuration.
  6. Rehearse the 72-hour clock. Make sure your incident plan covers a breach at a processor, including how you would assess risk and notify the ICO from incomplete supplier information.

Bottom line

The iRhythm breach is a reminder that patient data is often only as safe as the least-watched business application holding it. There is no evidence yet that UK patients are affected, but NHS and private providers using Zio should get that confirmed in writing. Every organisation should treat social engineering of helpdesk and identity processes as a primary route to data theft, not a side issue.

Sources

Related Posts