iRhythm Technologies, the San Francisco maker of heart monitoring devices, has begun notifying people that their data was accessed in a June 2026 cyberattack. A Texas Attorney General report lists 298,647 affected Texans, and the company says birth dates, insurance numbers and service dates were involved.
iRhythm Technologies’s Data Breach Investigation
iRhythm Technologies, Inc. is a San Francisco, California company that makes cardiac monitoring devices and cloud-based analytics used to diagnose and track patients with heart rhythm conditions. A company that supports patient monitoring at that scale holds names, contact details, insurance information and records of when services were provided, which makes it a significant target for criminals.
According to the company’s public disclosures, iRhythm identified unauthorized access to certain business applications hosted on a third-party platform on or around June 8, 2026. A security-news report says the intruder gained access through social engineering, and that the company received a message on June 9, 2026 from a threat actor who claimed to have taken data and demanded payment. iRhythm described the incident as material in a federal securities filing dated June 15, 2026.
After a forensic investigation and data review, the company said that stored data was accessed and downloaded without authorization between June 3 and June 8, 2026. It began notifying affected individuals on October 2, 2026, starting with people for whom it holds contact information. iRhythm has said it found no impact on its devices, clinical systems, customer connections, manufacturing or patient safety, and that it does not store individual financial account or payment card information.
On October 6, 2026, a data security breach report for iRhythm was published on the Texas Attorney General’s public breach reporting portal. It lists 298,647 Texans as affected and states that notice was provided by U.S. Mail, by publication in print media and by a posting on the company’s website. The Texas figure counts only Texas residents, so the total number of people affected nationwide has not been confirmed in the sources reviewed for this page and may be higher.
The data involved, according to the company, includes patient names, contact details, account numbers, insurance numbers, device serial numbers, service dates and birth dates. The Texas report lists names, addresses, medical information, health insurance information, dates of birth and an unspecified other category. The company says it has no evidence that the exposed information has been or will be used for identity theft.
Even without a Social Security number or financial account details, this combination of data can be misused. Insurance and account numbers can be used in medical identity fraud, where someone uses another person’s coverage to obtain care or submit false claims. A full name, birth date, address and device or service history also give scammers what they need to write convincing phishing messages that appear to come from a health plan, a doctor or the device maker.
Notice letters are normally the first reliable source of specifics for each person. They typically explain what happened, list the information involved for the recipient, describe the steps taken in response, and sometimes offer free credit monitoring or identity protection. Keep any letter you receive and read it closely for enrollment deadlines and contact details.
Third-party hosted business applications, the kind of systems named in the company’s disclosure, are widely used to manage customer accounts, scheduling and support. When one of them is reached through a stolen login or a convincing phone call or message, an intruder can sometimes view and download large volumes of records without touching the organization’s core systems. That is consistent with the company’s statement that its devices and clinical systems were not affected, even though patient data was.
Healthcare technology companies are expected to protect patient information with reasonable safeguards such as strong authentication, limits on who can reach sensitive systems, staff training against social engineering, and monitoring for unusual downloads. If you are a current or former iRhythm patient, there is no need to assume your information was taken, but it is sensible to stay alert for mail from the company, review insurance statements, and treat unexpected calls, texts or emails about your care with caution.
When Did This Breach Occur?
iRhythm says the unauthorized access and download of data took place between June 3 and June 8, 2026, and that it identified the access on or around June 8, 2026. It began notifying affected individuals on October 2, 2026, and a report listing the incident was published on the Texas Attorney General’s portal on October 6, 2026.
What Information Was Breached?
iRhythm says the affected data includes patient names, contact details, account numbers, insurance numbers, device serial numbers, service dates and birth dates. The Texas Attorney General’s report lists names, addresses, medical information, health insurance information, dates of birth and an unspecified other category. Not every category necessarily applies to every person.
What You Can Do
If you are an iRhythm patient, consider these steps:
- Watch your mail for a notice from iRhythm and keep any letter you receive.
- Review insurance explanation of benefits statements and claims for services, devices or prescriptions you did not receive, and tell your insurer about anything suspicious.
- Check your credit reports for free at annualcreditreport.com, and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- If you are offered credit monitoring or identity protection, read the terms and enroll before any stated deadline.
- Be cautious with unexpected calls, texts or emails that mention your heart monitor or this incident, and confirm any request through a phone number you already trust.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against iRhythm Technologies
If you are a current or former iRhythm patient and received notice about this incident, or believe your information was exposed, you may have legal options. Healthcare technology companies are expected to safeguard the sensitive patient information they hold, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
