Quick answer
Patient names, contact details, dates of birth, insurance information, and dates of service were taken. The company says payment card and bank account information were not involved, and its heart monitors and medical systems were not affected. The most important step is to check your health insurance statements for services you didn't get, and to be wary of scam calls or emails that mention iRhythm or your heart monitor.
What happened
iRhythm says unauthorized people accessed certain third-party-hosted business applications between June 3 and June 8, 2026, and downloaded patient data. In a filing with the U.S. Securities and Exchange Commission, the company said it discovered the activity on June 8, received a ransom demand on June 9, and considered the incident material because of the volume of data involved.
The company says its Zio products, clinical systems, manufacturing, and patient safety were not affected. It began mailing notices to patients on October 2, 2026.
iRhythm hasn't published a total number of people affected. Based on state breach filings, news reports estimate it at about 8.2 million patients, which would make it one of the largest healthcare breaches of 2026.
What information was exposed
- Name, home address, email address, and phone number
- Date of birth
- iRhythm patient account number and heart monitor serial number
- Health insurance information
- Dates of service
iRhythm says it doesn't keep payment card or financial account information.
What to do now
- Read your notice letter. It will say what information of yours was involved and whether any services are being offered.
- Check the explanation of benefits statements from your health insurer. Report any visit, test, or device you don't recognize. Insurance details can be used for medical identity theft.
- Watch for scam calls, texts, and emails that mention this breach. Scammers often pose as iRhythm, your doctor, or your insurer or a "breach settlement" service. Don't share passwords, codes, or payment details, and contact iRhythm, your doctor, or your insurer using a number you look up yourself.
- Be careful with unexpected calls about your heart monitor, a "device recall," or an unpaid bill. Hang up and call iRhythm or your doctor directly.
- Get your free credit reports at AnnualCreditReport.com and look for accounts you didn't open.
Ask iRhythm to delete your data
Every copy of your information that a company keeps is one more copy that can be stolen later. iRhythm is a healthcare provider, so your medical records are covered by HIPAA. Those records generally aren't covered by state privacy-law deletion rights, and providers must keep them for set periods. Other information, such as marketing or website data, may still be deletable.
Your legal right to deletion
If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, iRhythm generally has to respond to your deletion request within the deadline your state sets. Medical records covered by HIPAA are generally exempt, but other information it holds about you may not be. See what your state's law requires.
Find every company that has your data
A breach is a good reminder of how many companies hold your information. DataTrail scans your inbox (read-only) to find them all, flags the ones with data breaches, and writes the deletion requests for you to send.
Become a testerSources: California Attorney General breach notice, BankInfoSecurity, and Beinsure. DataTrail isn't affiliated with iRhythm. This page is general information, not legal advice.