iRhythm 2026 Cyberattack Patient Data Stolen

iRhythm Technologies, a U.S.-based digital healthcare company specializing in remote cardiac monitoring and arrhythmia detection, disclosed a cyberattack that resulted in the theft of patient and proprietary data. The breach was publicly disclosed in June 2026, though the exact discovery date and number of affected records were not specified. The incident involved unauthorized access through third-party applications, leading to data exfiltration and a subsequent ransom demand.

The attack vector involved exploitation of third-party applications, though specific technical details such as the initial access method or exploited vulnerabilities were not disclosed. The threat actor remains unidentified, and no specific ransomware group or hacker collective has claimed responsibility. The stolen data includes patient health information and proprietary company data, but the exact types of compromised data (e.g., medical records, financial information) were not detailed.

Post-incident developments are limited; iRhythm has confirmed the breach and the ransom demand but has not disclosed whether the ransom was paid or if regulatory notifications have been made. No information is available regarding litigation, regulatory actions, or containment milestones.