The iRhythm data breach 2026 has affected at least 368,173 people based on notices filed in Texas and South Carolina, though the cardiac-monitoring company has not disclosed a complete nationwide total. The two state figures, reported by Recorded Future News, are 298,647 people in Texas and 69,526 in South Carolina.
That total is a floor, not the final count. iRhythm began filing notices in multiple states this week concerning unauthorized access connected to a June incident, according to Recorded Future News. A company spokesperson declined to provide the full number of affected people.
iRhythm is known for its Zio cardiac monitors, which patients wear for extended heart-rhythm monitoring. The company said the incident did not affect its clinical systems or medical devices, and did not cause a service outage or operational disruption. It also said its products, manufacturing and distribution operations were unaffected.
What information was exposed in the iRhythm breach?
According to the company’s reported notices, the accessed and downloaded information may include names, home addresses, phone numbers, iRhythm patient account numbers, device serial numbers, insurance numbers, service dates and dates of birth.
iRhythm said it found no evidence that the personal information had been used, or would be used, for identity theft. That is the company’s assessment, not a guarantee that stolen data cannot later be misused.
Recorded Future News reported that attackers had access to iRhythm systems from June 3 through June 8. The company’s investigation found that the intruders reached unidentified third-party-hosted business applications through what iRhythm described as a social-engineering attack. The company has not identified the applications in the reported disclosures.
What did iRhythm disclose about the attack?
In a June filing with the Securities and Exchange Commission, iRhythm said it had received messages from a threat actor claiming to possess proprietary data, patient protected health information and other personal information. The actor demanded payment in exchange for not publicly releasing the material, according to the filing described by Recorded Future News.
iRhythm later confirmed that certain data had been taken from the affected applications. No hacking group had publicly claimed responsibility at the time of the report.
The company said it notified affected individuals and regulators after verifying the scope of the incident. The reported disclosures do not establish which listed data types applied to every affected person.
How should patients treat follow-up messages?
People who receive an unexpected message asking for personal information or urgent action should verify the sender independently through an organization’s known contact details, rather than using links or phone numbers supplied in the message. CISA advises against disclosing personal or financial information in response to unsolicited email and recommends verifying an unfamiliar person’s claimed identity directly with the organization.
This story draws on original reporting from The Record.
