iRhythm, maker of Zio monitors, tells HHS 8,179,772 people were hit; letters came 116 days after detection

116 days from detection to the first letter, and 8,179,772 people on the federal register

iRhythm says it detected unauthorised access to certain third party hosted business applications "on or around June 8, 2026". Its letters to the people whose data was taken began on 2 October 2026. That is 116 days (derived). The next day, 3 October, the company's report reached the breach portal of the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR), which lists iRhythm Technologies, Inc. as a healthcare provider in California with 8,179,772 individuals affected, the type "Hacking/IT Incident" and the location "Network Server".

iRhythm sells the Zio service, wearable heart rhythm monitors and the reports drawn from them, so it holds patient records at national scale; its own statements are the main source here and it has an interest in how the incident is read. This briefing reads the primaries rather than the coverage: the HHS OCR portal entry, iRhythm's web notice dated 2 October, the sample letter it filed with the California Attorney General, and the Washington Attorney General's list. They were read from 11:19 UTC on Thursday 29 October 2026 and read again at 11:34 UTC. SecurityWeek reported the HHS listing that morning, and its report is used only for the Oregon figure and for what it says iRhythm said.

What the 116 days does not establish is a breach of the law. The HIPAA Breach Notification Rule tells a covered entity to notify each affected person "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (45 CFR 164.404). Sixty days from 8 June is 7 August (derived), so the letters came 56 days after that mark. But the rule's clock runs from the day a breach is known, not from the day suspicious access is spotted, and a law enforcement official can lawfully ask for a delay (45 CFR 164.412). No source read for this briefing says which date iRhythm treats as discovery, or whether any delay was requested. HHS OCR lists the report under "HIPAA Cases Currently Under Investigation"; the portal says that page lists breaches reported within the last 24 months that are under investigation, and a listing is not a finding.

The count is also a count of individuals reported by the company, not a count of records, accounts or devices, and no regulator has published its own figure. What the record does show is a long gap, a large population, a short list of data fields, and an unnamed third party whose role the federal form does not record.

Five dates that should not be blurred into one

Breach stories collapse the access window, discovery, containment, notification and publication into a single "June breach". They are different events here, and two of them come only from iRhythm. The table keeps them apart, with the source for each.

Zoom

Two dates carry a caution. Security Affairs, writing on 16 June, says the 8-K was filed on 10 June; iRhythm's own notice calls it the Form 8-K "dated June 15, 2026". The SEC's EDGAR site refused this briefing's request with a 403 response and iRhythm's investor site did the same, so the 8-K itself was not read, and the 9 June demand rests on Security Affairs' quotation of it. Security Affairs also names the 8-K's filer as iRhythm Holdings, Inc., while HHS OCR, California and Washington list iRhythm Technologies, Inc.; the sources read do not explain the relationship.

People, not records: what was taken, field by field

The 8,179,772 figure is the number of individuals iRhythm reported to HHS. SecurityWeek says it is the same number iRhythm reported to the Oregon Attorney General; Oregon's site disallows automated reading in its robots.txt, so that match is SecurityWeek's, not this briefing's. Washington's list gives 220,745 Washingtonians, which is 2.7 per cent of the federal figure (derived). California posted the sample letter with the breach dates and no count.

The data fields are short and specific. The web notice says the review "concluded the impacted data includes" seven kinds of data; the sample letter to each person says the data "may include" the same list. Neither mentions Social Security numbers, financial account or payment card data (the notice says iRhythm does not store or retain them), heart rhythm recordings, reports or diagnoses.

Zoom

Combined, the fields describe who wore a cardiac monitor, when, under which insurance, with the person's home and email address and date of birth. That is the material for convincing medical billing and insurance fraud, and for phishing that names the device and the date of service. iRhythm says it "has no evidence that any personal information has been or will be used to commit identity theft". SecurityWeek notes the notice does not offer free identity theft or credit monitoring services, and the notice and letter read for this briefing offer none.

Third party hosted, network server, no business associate

"Third party hosted business applications" is a comforting phrase. It places the incident somewhere outside iRhythm, in someone else's software, and away from the Zio devices. The record does not support reading it as someone else's problem. iRhythm's notice says the data taken is "data we store", and its report to HHS records Business Associate Present: No and a location of Network Server, with an empty web description.

Zoom

HIPAA defines a business associate as a party that, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" (45 CFR 160.103). A company that hosts business applications holding patient data for a healthcare provider would ordinarily look like one. Several readings fit the record, and none is confirmed: the host may run software that iRhythm alone operates and the form was answered on that basis; the applications may be ones iRhythm runs itself on rented infrastructure; or the form field may have been answered on another view. Which application, which vendor, and how the attackers got in are not stated in any primary read. Security Affairs wrote in June that the breach came through a social engineering attack; the 8-K passages it quotes do not contain that, and iRhythm's October notice does not say it, so it is treated here as unconfirmed.

Zoom

The second comforting line is about devices. iRhythm says it has "not identified any impact to our products, our clinical or medical device systems, our connections to customers, our manufacturing and distribution operations, patient safety, or our ability to meet patient needs". That is a statement about operations, attributed to the company, not an independent finding, and it says nothing about the data taken. A device serial number in a stolen table is exactly what lets a fraudster sound like the device maker.

Stated and not stated

"Not stated" means not found in any source read for this briefing. It does not mean the information does not exist; the 8-K, Oregon's entry and other state filings were not read.

On the extortion itself: the claim that patient data was taken and the demand for payment are, as quoted, the threat actor's claims, and iRhythm later confirmed that data was accessed and downloaded. Security Affairs wrote on 16 June that no ransomware group had publicly claimed the attack. This briefing did not visit any criminal leak site and found no later claim in the sources it read, so whether the data has been published or sold is unknown.

Letters, a web notice and a 90 day posting

iRhythm says it notified, from 2 October, "impacted individuals for whom we have contact information". HIPAA requires substitute notice where contact details are missing for 10 or more people, which can be a conspicuous posting on the home page of the covered entity's website for 90 days with a toll free number active for at least 90 days (45 CFR 164.404). iRhythm's US home page carries a "Notice of data event" button to the notice, and the notice gives a toll free response line. If the posting began on 2 October, 90 days runs to 31 December 2026 (derived); the notice does not say it is a substitute notice or how many people had no contact details.

For a breach of 500 or more people, the rule also requires notice to the HHS Secretary "contemporaneously" with the letters (45 CFR 164.408), and notice to prominent media in any State with more than 500 affected residents (45 CFR 164.406). The one day gap between the letters and the HHS submission fits the first. Whether media notice was given in each state is not stated in the sources read.

Technical details

None of the primaries publishes an indicator of compromise: no address, domain, file name, account name, hash or attack technique. iRhythm has not named the application or the vendor. So there is nothing to hunt for by indicator, and this section reproduces instead the records a defender, an insurer or an affected patient can check, copied exactly from the saved sources.

First, the federal record. These are the values in the HHS OCR portal row and its expanded detail, set out by this site as label and value. A compliance lead can compare it with the company's own description: the form says network server and no business associate, the notice says third party hosted applications.

Name of Covered Entity:           iRhythm Technologies, Inc.
State:                            CA
Covered Entity Type:              Healthcare Provider
Individuals Affected:             8179772
Breach Submission Date:           10/03/2026
Type of Breach:                   Hacking/IT Incident
Location of Breached Information: Network Server
Business Associate Present:       No
Web Description:                  (empty)

Second, iRhythm's own wording of what happened, when, and which fields. These three sentences are the whole of the company's public technical account; the detection sentence and the access window are the two dates a reader should not merge.

On or around June 8, 2026, iRhythm detected unauthorized access in certain third-party-hosted business applications.

After completing our forensic investigation, we learned certain data we store was accessed and downloaded by unauthorized individuals between June 3 and June 8, 2026.

This review concluded the impacted data includes: patient name; patient contact information, including address, email address, and phone number; iRhythm patient account number; iRhythm device serial number; patient insurance number; date of service; and date of birth.

Third, the June disclosure as Security Affairs quotes iRhythm's 8-K. The filing itself was not read for this briefing, so these lines are secondary quotations of a primary.

“On June 8, 2026, iRhythm Holdings, Inc. identified unauthorized activity involving data maintained on certain third-party-hosted business applications.”

“On June 9, 2026, the Company received communications from a threat actor claiming to have obtained sensitive information, including proprietary data, patient protected health information and other personal information.”

“The communications from the threat actor demanded payment in exchange for not publicly disclosing this information.”

Fourth, the Washington Attorney General's row, which gives a state count and the state's own data categories, including Medical Information, which iRhythm's list does not use.

Date Reported:                     10/06/2026
Organization Name:                 iRhythm Technologies Inc.
Date of Breach:                    06/03/2026
Number of Washingtonians Affected: 220745
Information Compromised:           Name; Full Date of Birth; Health Insurance Policy or ID Number; Medical Information; Protected Health Information owned or licensed by a HIPAA covered entity

A checklist for a health provider or device maker using hosted business applications

In the order worth doing. None of these is drawn from iRhythm's account of its own controls, which it has not published; they follow from what the record shows was taken and where. An earlier briefing on a vendor key at Denver Health Medical Plan shows the same pattern of patient data held outside the covered entity's own walls.

The question

iRhythm saw the access on or around 8 June, was told the next day that patient data had been taken, and mailed the first letters on 2 October, 116 days after detection. Its report to HHS says no business associate was involved in data that sat in a third party's hosted applications. So the question is the one that decides both the clock and the accountability: on what date did iRhythm treat this as a discovered breach of patient health information, and which company held the applications the data was taken from?

Key facts