The iRhythm data breach has now been put at 8,179,772 people on the United States Department of Health and Human Services breach portal, turning a June hacking incident at the maker of the Zio wearable heart monitor into one of the largest health-data breaches of 2026. The listing, reported on Thursday, October 29, matches the figure iRhythm previously reported to the Oregon Attorney General, and suggests the intruders reached data covering effectively the company's entire patient base.

iRhythm Technologies, based in San Francisco, describes itself as a world leader in managing cardiac arrhythmia information, with more than 8 million patients in the United States and Europe and more than 1.5 billion hours of heartbeat data analysed. Its Zio monitors are small patches patients wear at home for days at a time while the device records every heartbeat, which is why the breach has alarmed cardiologists and patients alike even though the company says its devices themselves were never compromised.

Key Points

• The iRhythm data breach is now listed on the HHS breach portal as affecting 8,179,772 individuals, the same total iRhythm reported to the Oregon Attorney General.
• Unauthorised individuals accessed and downloaded data from third-party-hosted business applications between June 3 and June 8, 2026, after gaining access through social engineering.
• Exposed data included names, addresses, dates of birth, email addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers and dates of service.
• A threat actor contacted iRhythm on June 9, 2026, claiming to hold proprietary data and patient health information and demanding payment not to release it; the company has not disclosed whether it paid.
• iRhythm says it has no evidence personal information has been or will be used for identity theft, and says its products, clinical systems and patient safety were not affected.

What Happened

The incident began as a social-engineering attack, not a break-in through a software flaw. According to iRhythm's filings and the breach reports that followed, someone talked their way into business applications hosted by third parties and downloaded patient data from them between June 3 and June 8, 2026. The company identified the unauthorised access on June 8 and disclosed the incident to the Securities and Exchange Commission in mid-June, but that first filing did not state how many people were affected.

The next day, June 9, the extortion began. A threat actor contacted iRhythm claiming to hold sensitive information, including proprietary data and patient protected health information, and demanding an undisclosed payment in exchange for not publicly releasing it. The actor has not been publicly named, and iRhythm has not said whether any payment was made. That silence is itself part of the story: extortion demands in health-care breaches put companies in an impossible position, because paying does not guarantee the data will be deleted, and refusing leaves patients exposed.

Patient notification did not begin until early October, nearly four months after detection. iRhythm started sending notification letters to potentially affected individuals and filed notices with regulators in several states as well as with HHS. The state-by-state filings told a confusing story at first: Texas listed 298,647 affected residents and South Carolina 69,526, a confirmed state total of about 368,000. Then an October 6 filing with the Oregon Attorney General, which became public on October 15, put the national scope at 8,179,772 people. The HHS portal listing reported on October 29 confirms that larger figure as the official federal count.

Background: A Company Built on Heartbeat Data

To understand why this breach matters, it helps to understand what iRhythm does. Cardiac arrhythmias — irregular heartbeats — are often intermittent, which means a standard electrocardiogram in a doctor's office can miss them entirely. Zio patches solve that problem by recording continuously for days or weeks while patients go about their lives, giving cardiologists a far richer picture than a single clinic visit. That richness is also the risk: the business systems around those devices hold names, contact details, insurance information and device identifiers for millions of people, all of it valuable to identity thieves and medical-fraud schemes.

iRhythm has stressed throughout that the breach touched business applications, not its clinical world. In its own words, it has "not identified any impact to our products, our clinical or medical device systems, our connections to customers, our manufacturing and distribution operations, patient safety, or our ability to meet patient needs." The company also says it does not retain financial account or payment card data, which limits — but does not remove — the financial exposure. What was taken is still enough to build a detailed profile of a patient: who they are, where they live, when they were born, how to contact them, which device they wore, which insurer covers them and when they were treated.

The timeline also raises a familiar question about breach disclosure. Federal rules require health-care breaches affecting 500 or more people to be reported to HHS, and the portal is the public record of those reports. But the gap between the June intrusion and the October notifications — and the gap between the first state filings of a few hundred thousand people and the eventual 8.2 million total — shows how long it can take for the full scale of a breach to become public, even when the company discloses the incident itself within days.

iRhythm Data Breach: What Was Taken and What Was Not

The data elements named in iRhythm's notices are consistent across the state filings and the HHS listing: patient names, addresses, dates of birth, email addresses and phone numbers, together with iRhythm account numbers, device serial numbers, insurance numbers and dates of service. That combination is particularly sensitive in a health-care context, because medical identity theft — using someone else's identity to obtain treatment, drugs or equipment — can corrupt medical records in ways that are far harder to undo than a fraudulent credit-card charge.

What was not taken matters too. iRhythm says its devices were never compromised, its clinical and medical device systems were not affected, and there was no service interruption for patients wearing monitors. In other words, the hack did not interfere with anyone's heart monitoring in real time. The harm here is not a missed heartbeat; it is the quiet, long-term exposure of personal health information to people who stole it and tried to sell its silence.

Security researchers tracking the incident have pointed to a broader lesson that goes beyond one company. The attack did not need a vulnerability in a heart monitor or a hospital system. It needed a person to be persuaded to open a door into business software hosted by someone else, and then a large download from that software. As health care moves more patient data into cloud business applications — scheduling, billing, customer management — those applications hold as much sensitive information as core clinical systems, and often receive less scrutiny. Phishing-resistant authentication, strict help-desk identity checks and monitoring of large data exports are the controls experts cite most often, and this breach is now one of the clearest 2026 examples of why they matter.

Reactions and Quotes

iRhythm's public statements have been measured and consistent. "iRhythm has no evidence that any personal information has been or will be used to commit identity theft," the company said earlier this month, while encouraging potentially affected individuals to protect themselves against medical identity theft and identity fraud. Its notice, however, does not mention free identity theft or credit monitoring services — an omission that patient advocates routinely criticise in large breaches, because the cost of vigilance falls on the people whose data was taken.

The company has also declined to publish its own national total, telling reporters only that the number of affected individuals is reflected in its required regulatory filings. That is technically true — the Oregon filing and now the HHS portal both carry the 8,179,772 figure — but it has left journalists and patients to assemble the total from filings rather than hearing it directly from the company. Asked about the figure, iRhythm pointed to the regulatory record rather than confirming a headline number of its own.

The absence of a named threat actor is another open thread. No group has publicly claimed the iRhythm extortion, and no law-enforcement announcement tying the incident to a known ransomware or extortion crew has been reported. That does not mean the data is safe: extorted health data has a long shelf life, and stolen medical identities can be used months or years after the original theft, which is why the company's "no evidence of misuse" statement, while reassuring, cannot be read as a guarantee.

Why It Matters

At 8.2 million people, the iRhythm breach sits among the largest health-data incidents of the year, and it lands in a sector that has become a prime target precisely because health data is both rich and durable. A credit card can be cancelled; a date of birth, a medical history and an insurance identity cannot. When that information is combined with device and treatment dates, it can be used to impersonate patients, file false claims or obtain controlled substances — harms that may surface long after the breach itself fades from the headlines.

The breach also matters for how patients judge the companies that hold their health data. Wearable health technology asks for extraordinary trust: patients stick a sensor to their chest and let a company record their heart for days, on the understanding that the data will be guarded as carefully as a hospital chart. iRhythm says its clinical systems held up. But the business systems around them did not, and for patients the distinction between a "business application" and a "clinical system" is meaningless once their name, address and insurance number are in a thief's hands.

For the wider health industry, the incident is a warning about the perimeter. The most sensitive data a health company holds is no longer only in its own data centre; it is spread across hosted applications, vendors and support tools, each with its own login, help desk and export button. A single persuaded employee or vendor contact can open a door that no firewall was designed to stop. Regulators, insurers and hospital partners are all likely to ask harder questions about those doors after a breach of this size.

What Happens Next

The immediate next step belongs to patients. Anyone who wore a Zio monitor should watch for a notification letter from iRhythm if they have not already received one, and should read it carefully for the specific data elements listed for them. Patients should also watch explanations of benefits from their insurer, question any medical bill or treatment record they do not recognise, and consider placing a fraud alert with the credit bureaus — standard steps after any large health-data breach, and especially important when insurance numbers are among the exposed data.

Regulators and litigators will be watching too. Large health breaches routinely draw state attorney general inquiries and class-action lawsuits, and the four-month gap between detection and notification, plus the staged revelation of the total, are likely to feature in both. iRhythm has not announced any additional protective offering beyond its notice, and whether it adds credit or identity monitoring — or faces pressure to do so — is one of the open questions in the weeks ahead.

US News Pulse will update this story if iRhythm publishes a national total of its own, if law enforcement names the threat actor, or if evidence emerges that the stolen data has been misused or released.

Frequently Asked Questions

How many people were affected by the iRhythm data breach?

The HHS breach portal lists 8,179,772 individuals, matching iRhythm's filing with the Oregon Attorney General. Earlier state filings confirmed about 368,000 people in Texas and South Carolina alone.

When did the iRhythm breach happen?

Unauthorised individuals accessed and downloaded data from third-party-hosted business applications between June 3 and June 8, 2026. iRhythm identified the access on June 8 and disclosed the incident to the SEC in mid-June.

Was the Zio heart monitor itself hacked?

No, according to iRhythm. The company says its products, clinical and medical device systems and patient safety were not affected, and there was no service interruption. The breach involved business applications hosted by third parties.

What personal information was exposed?

Names, addresses, dates of birth, email addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers and dates of service. iRhythm says it does not retain financial account or payment card data.

What should patients who wore a Zio monitor do?

Read any notification letter from iRhythm, watch insurer explanations of benefits for unfamiliar treatment, question medical bills you do not recognise, and consider a fraud alert with the credit bureaus. Report suspected medical identity theft to your insurer and to the company.

Related coverage: Darwin's Cat Food Salmonella Alert: FDA Warns Two Lots After Cat Hospitalised | Toothpaste Recall: 43 Million Tubes Pulled Nationwide | Early Flu Season Hits US Weeks Ahead as Mutated H1N1 Drives Surge in 44 States