iRhythm Holdings discloses cybersecurity incident costs in SEC 8-K filing
iRhythm Holdings discloses costs tied to a cybersecurity incident in an SEC 8-K filing without details. Customers should watch for official notices.
- Published
- Ecosystem
- Enterprise software
- Exploitation
- No, the filing gives no details on any intrusion, cause or affected data
What happened
On November 5, 2026, iRhythm Holdings, Inc. (NASDAQ: IRTC) disclosed a cyber incident in an SEC Form 8-K filing, according to SEC EDGAR. The filing’s exhibit is the company’s third quarter 2026 earnings press release. That document mentions the incident only once.
iRhythm says its adjusted EBITDA measure excludes “costs related to the cybersecurity incident (net of expected insurance recoveries),” according to the press release filed with SEC EDGAR. This indicates that the company recorded incident-related costs and expects some of them to be covered by insurance.
The filed text does not give any further information. The following details are not confirmed:
- When the incident occurred or was detected
- What kind of incident it was
- How the attackers got in
- Which systems were affected
- Whether patient, customer or other data was accessed
- The size of the related costs
- Whether any group has claimed responsibility
No independent outlet has reported on the incident in the sources provided.
Am I affected?
Not confirmed. The filing does not identify any affected individuals, customers, products or services. iRhythm describes itself as a digital health care company. It combines wearable biosensors and cloud-based data analytics, and its products include Zio Monitor, according to SEC EDGAR. The filing does not say whether any of these products or the data they handle were involved.
What to do now
- Watch for direct communication from iRhythm. The filing does not say whether notifications are planned.
- Check iRhythm’s SEC filings on EDGAR for any later disclosure that adds detail about the incident.
- Treat unexpected messages that claim to be about an iRhythm incident with care, and verify them through contact details you already know. This is general practice, not guidance from the filing.