The facts
The US health department’s breach register records an iRhythm submission dated 3 October, describing a hacking incident involving a network server. [1]
iRhythm says an unauthorised party accessed and downloaded information from third-party-hosted business applications between 3 and 8 June. It detected the incident around 8 June. [2]
Potentially affected information includes names, contact details, dates of birth, patient and insurance account numbers, device serial numbers and service dates. [2]
The company says it identified no impact on its products, clinical or device systems, patient safety or ability to serve customers. It says notifications began on 2 October. [2]
iRhythm says it has no evidence of resulting identity theft. That statement does not establish that misuse cannot occur. [2][3]
Still unconfirmed
- The full extent of subsequent misuse and the attackers’ identities are not established.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 13:55 UTC.
- Breach portal: iRhythm Technologies entry
US Department of Health and Human Services, Office for Civil Rights · Primary source
Current aggregate registry row read on 29 October: 8,179,772 individuals; submission date 10/03/2026. No individual patient records were accessed.
- Notice of data event
iRhythm Technologies · Primary source · 2 Oct 2026
Updated company notice distinguishes June intrusion, October notification and unaffected clinical systems.
- HHS filing puts iRhythm data breach toll at 8.2 million
SecurityWeek · Reporting · 29 Oct 2026
Independent security newsroom; its 29 October report is not treated as the original breach or filing date.