Breaches · 23h ago
iRhythm said a June 8 breach exposed data on at least 360,000 Zio Patch patients, including 298,647 people in Texas and 69,526 in South Carolina. The company began notifying states this week after finding unauthorized access to third-party-hosted business applications.
iRhythm said attackers used social engineering to reach those apps, then downloaded records already stored there. The stolen data included names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service, and dates of birth; the company said its clinical systems, medical devices, manufacturing, and distribution were not affected.
The case shows how a compromise outside the clinical network can still become a major healthcare-privacy incident when business applications hold patient data at scale. For organizations that keep PHI or PII in SaaS tools, the exposure can remain even when core systems stay untouched.
2 sources covering this story
iRhythm Data Breach Impacts at Least 360,000 People
Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers.
The Record from Recorded Future
Hundreds of thousands impacted by data breach at biosensor firm iRhythm
A company known for wearable cardiac sensors, iRhythm, has begun notifying states of the impact of a data breach from the summer.
Part of the PlainSec briefing for 2026-10-13