iRhythm said a June 8 breach exposed data on at least 360,000 Zio Patch patients, including 298,647 people in Texas and 69,526 in South Carolina. The company began notifying states this week after finding unauthorized access to third-party-hosted business applications.
iRhythm said attackers used social engineering to reach those apps, then downloaded records already stored there. The stolen data included names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service, and dates of birth; the company said its clinical systems, medical devices, manufacturing, and distribution were not affected.
The case shows how a compromise outside the clinical network can still become a major healthcare-privacy incident when business applications hold patient data at scale. For organizations that keep PHI or PII in SaaS tools, the exposure can remain even when core systems stay untouched.