Breaches and incidents
iRhythm Technologies: notifies 8.18 million people of June 2026 social engineering data theft
iRhythm’s 8-K says it identified unauthorized activity on third-party-hosted business applications on 8 Jun 2026, received an extortion demand from a...
- Disclosed
- Verification
- Checked against a primary source
What happened
- iRhythm’s 8-K says it identified unauthorized activity on third-party-hosted business applications on 8 Jun 2026, received an extortion demand from a threat actor on 9 Jun, and confirmed data was exfiltrated. Update on a June disclosure: notification began in October (California AG listing dated 6 Oct 2026), and HIPAA Journal reports the Oregon AG was told 8,179,772 people were affected.
- Root cause: per the 8-K, data “was obtained through social engineering” from third-party-hosted business applications.
- The threat actor is not named; it demanded payment not to publish the data.
- The 8-K says no impact on devices or patient safety; HIPAA Journal lists patient names, contact details, account numbers, device serial numbers, insurance numbers and dates of birth among the data.