Data Breach at iRhythm Impacts Over 360,000 Patients

A cyberattack on medical device manufacturer iRhythm resulted in the unauthorized exfiltration of personal and health data belonging to at least 360,000 individuals. The incident, which occurred between June 3 and June 8, originated from a social engineering attack targeting third-party business applications. Stolen information includes patient names, addresses, insurance details, device serial numbers, and dates of service.

Regulatory filings indicate that the company received extortion demands from a threat actor seeking payment to prevent the public disclosure of the exfiltrated data. While the company confirmed the breach of sensitive information, it stated there is no current evidence of identity theft resulting from the incident. The firm has initiated mandatory breach notifications across multiple states, including Texas, South Carolina, and California.

Operational integrity remains intact, as the breach did not affect clinical systems, medical devices, or manufacturing processes. Despite the scale of the data exposure, the company reported no disruption to its financial operations or service delivery. This event highlights ongoing cybersecurity vulnerabilities within the medical device sector, which has seen a recurring pattern of data exfiltration incidents across several major industry participants.