iRhythm Data Breach Compromises Personal Data of Over 360,000 Patients
Hackers exfiltrated patient records from third-party apps in early June, prompting notifications and regulatory filings by the medical device maker.
Key points
- iRhythm confirmed that hackers stole personal information from more than 360,000 individuals, primarily in Texas and South Carolina.
- The intrusion occurred between June 3 and June 8, targeting third-party-hosted business applications rather than core clinical systems.
- Threat actors demanded a ransom on June 9, though the company states there is no evidence of identity theft occurring so far.
Medical technology provider iRhythm is notifying over 360,000 patients that their personal data was stolen by hackers during a breach in early June. According to regulatory filings and company statements, the incident involved unauthorized access to third-party-hosted applications storing patient records.
The compromise included sensitive personal identifiers such as names, physical addresses, email addresses, dates of birth, and telephone numbers. The stolen dataset also contained specific account and device metrics, including account numbers, serial numbers, insurance policy details, and dates of service provided by the company.
Scope and Timeline of Intrusion
SecurityWeek reports that iRhythm identified the breach on June 8, but forensic analysis determined that attackers had been accessing the data since June 3. The company stated that the intruders accessed and exfiltrated the information from the affected business applications during this five-day window.
Following the discovery, hackers contacted iRhythm on June 9, demanding a ransom payment in exchange for not leaking the stolen information online. The company has not publicly confirmed whether it paid the demand, though it noted in a recent statement that there is currently no evidence the data has been used for identity theft.
Regulatory Filings and Affected Regions
Data breach notices filed with state regulators indicate that at least 360,000 individuals were impacted by the incident. The majority of affected patients reside in Texas, with 298,647 individuals listed in that state’s filing. South Carolina reported 69,526 affected individuals.
iRhythm suggested in its filings that the total number of impacted patients is likely significantly higher than the current confirmed count. The company filed these notices with regulators in multiple states last week to comply with notification laws regarding the unauthorized disclosure of personal health-related information.
Operational Impact and Company Response
In a filing with the Securities and Exchange Commission, iRhythm stated that the incident is not reasonably likely to materially impact its financial condition or operational results. The company emphasized that its core products, clinical systems, and manufacturing operations remain unaffected by the security incident.
iRhythm described itself as a digital healthcare company that combines wearable cardiac monitoring biosensors with cloud-based analytics. The firm asserts that patient safety and its ability to meet medical needs have not been compromised by the breach of the third-party business applications.
SecurityWeek contacted iRhythm for additional details regarding the breach and will update its coverage if the company provides further commentary. The news outlet noted that the company’s statement about no identity theft suggests it may have complied with the extortion demands.
What should you do?
Individuals who received notification from iRhythm should review their credit reports and financial statements for unauthorized activity. Patients should monitor their inboxes for suspicious emails that might reference the stolen contact information. Those concerned about insurance fraud should contact their providers to place alerts on their accounts.
What to do and how to stay safe: iRhythm
- Check credit reports from major bureaus for new accounts or inquiries you did not authorize.
- Monitor bank and credit card statements regularly for transactions that do not match your spending history.
- Contact your health insurance provider to inquire about placing a fraud alert on your policy number.
- Be wary of phishing attempts that use stolen personal details to appear legitimate in future communications.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific personal information was stolen in the iRhythm data breach?
Hackers stole names, addresses, email addresses, dates of birth, phone numbers, account numbers, serial numbers, insurance numbers, and dates of service.
Did the hackers target iRhythm’s clinical or medical device systems?
No, iRhythm stated that the breach involved third-party-hosted business applications and did not impact clinical systems or patient safety.
How many people were affected by the iRhythm data breach?
At least 360,000 individuals were affected, with 298,647 in Texas and 69,526 in South Carolina, though the total number is likely higher.
