iRhythm Technologies, the San Francisco company behind the Zio device, says unauthorized individuals accessed and downloaded patient data from third-party-hosted business applications between June 3 and June 8, 2026. The company disclosed the incident to the SEC in June but did not begin notifying individual patients until October 2 — nearly four months after detection.

How the breach happened

The attack vector was social engineering, according to iRhythm's SEC filing. An attacker tricked their way into business applications hosted by third parties — not into iRhythm's clinical systems. The Zio devices themselves were never compromised, and the company reports no service interruption or patient safety impact.

Then came the extortion attempt. On June 9, 2026, iRhythm received communications from a threat actor claiming to hold sensitive information — including proprietary data and patient protected health information — and demanding payment to keep it private. The company has not disclosed whether it paid.

We covered the full timeline and confirmed numbers in our report on the iRhythm breach.

Confirmed figures: how many patients are affected

The confirmed count is at least 368,173: state filings list 298,647 affected individuals in Texas and 69,526 in South Carolina.

The larger figure — 8,179,772 — comes from an aggregation of regulatory filings, including an October 6 filing with the Oregon attorney general that became public on October 15 (as reported by HealthInfoSec). iRhythm has not published its own national total; asked about the figure, the company said only that the number of affected individuals is reflected in its required regulatory filings. Treat 8.2 million as the filed scope, not a confirmed count.

What data was exposed

Exposed data includes patient names, addresses, email addresses, phone numbers, dates of birth, iRhythm account numbers, device serial numbers, insurance numbers, and dates of service.

Two categories were not exposed: Social Security numbers and financial data such as payment cards or bank accounts, which iRhythm says it does not store on the compromised platform.

That combination is tailor-made for medical identity theft and targeted scams. With your name, date of birth, device serial number, and insurance details in hand, attackers can craft extremely convincing phishing calls about "device updates" or "billing issues."

What to do: 5 steps for Zio users

Take these steps now if you have ever used an iRhythm Zio device — whether or not you have received a notification letter, since the full affected list remains unconfirmed.

If your data shows up in a breach, work through our complete guide on what to do when your personal information is leaked.

1. Watch your Explanation of Benefits (EOB) statements for treatments or devices you never received — the clearest sign of medical identity theft.

2. Treat unsolicited calls or emails about your heart monitor, insurance, or billing as hostile until verified through iRhythm's official channels, and confirm any breach notification letter genuinely came from iRhythm rather than a lookalike sender.

3. Change your iRhythm patient portal password — especially if you reuse it elsewhere — and request your free medical records from providers you've used to scan for unfamiliar entries.

4. Place a fraud alert with one credit bureau as an extra precaution, since medical identity theft can precede financial fraud.

5. Save iRhythm's official breach notice and document every suspicious contact, in case you need evidence later.

The timeline

• June 3–8, 2026 — Unauthorized access to third-party-hosted business applications; intrusion detected around June 8.

• June 9, 2026 — iRhythm receives extortion communications from a threat actor.

• June 2026 — Incident disclosed to the SEC.

• October 2, 2026 — Individual patient notifications begin, nearly four months after detection.

• October 15, 2026 — Oregon attorney general filing becomes public, putting the filed scope at 8.2 million people.

A note on HIPAA

The gap between detection and patient notification is drawing scrutiny. Some coverage has raised questions about whether the delay meets HIPAA's 60-day breach notification rule — though no regulator has made a finding, and the incident had not appeared in the federal breach portal as of mid-October. Note that HIPAA's 60-day clock runs from discovery, and how a company defines the affected population also factors into compliance.

iRhythm says it has no evidence that stolen information has been used for identity theft — reassuring only up to a point: absence of evidence is not evidence of absence.

Bottom line

For patients, the practical takeaway doesn't depend on the final headcount. Whether the number is 368,000 or 8.2 million, the exposed data is likely the same, and the scam risk is real today. Check your statements, distrust unexpected calls about your device, and don't wait for a letter to act.

Sources: HealthInfoSec, Security Boulevard, BeInsure.

Originally published on TechReview.si