What Happened in the iRhythm Technologies Data Breach?
iRhythm Technologies, the company behind the widely used Zio cardiac monitoring platform, has confirmed a data breach involving unauthorized access to its computer systems. The iRhythm Technologies data breach came to light after the company discovered suspicious activity on its network on June 8, 2026. As a result, iRhythm launched an internal review to determine the scope of the intrusion.
According to public disclosures, threat actors gained unauthorized access to iRhythm’s systems and stole patient information. The exact method the attackers used to break in has not been made public. However, the company confirmed that the unauthorized access led to the theft of personal and health-related data belonging to affected individuals.
Following the discovery, iRhythm Technologies disclosed the incident to the U.S. Securities and Exchange Commission on June 10, 2026. This filing came just two days after the breach was found, suggesting a fast-moving response once the intrusion was identified. In addition, the company posted a cybersecurity statement on its own website to inform the public.
At this stage, iRhythm has not released full details about how the forensic investigation was conducted or what security gaps allowed the attackers to get in. Because the investigation may still be ongoing, more information could come out in the coming weeks. Affected individuals should watch for updates directly from the company.
Who was affected?
The iRhythm Technologies data breach likely affects patients who used the company’s Zio cardiac monitoring devices or related services. Since iRhythm operates as a medical device and remote monitoring provider, the exposed data may belong to people who underwent heart monitoring through the company’s platform. Healthcare providers who ordered these devices for patients could also be indirectly affected.
As of now, the total number of individuals affected in the United States has not been publicly reported. This means the true scope of the breach remains unclear. Given that iRhythm serves patients across the country, the breach could potentially involve a large population of consumers.
It also isn’t known whether the breach affected minors, though cardiac monitoring services can sometimes involve pediatric patients. Because health data often includes sensitive diagnostic details, the population affected could span a wide range of ages and medical backgrounds. Individuals who received a Zio monitor or interacted with iRhythm’s systems should consider themselves potentially at risk until more details emerge.
What Information Was Potentially Exposed?
Public disclosures have not detailed the exact categories of information compromised in this breach. However, based on the nature of iRhythm’s business and the type of data it typically collects, several categories of personal and health information may have been exposed.
- Full names
- Social Security numbers
- Financial account details
- Medical records
- Health insurance information
- Cardiac monitoring data and diagnostic results
If Social Security numbers and financial details were indeed exposed, affected individuals could face a heightened risk of identity theft. Criminals often use stolen Social Security numbers to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. This type of fraud can take months to detect and even longer to fully resolve.
In addition, exposed medical records and health insurance information carry their own unique risks. For example, thieves can use stolen health insurance details to receive medical treatment under someone else’s identity, a practice known as medical identity theft. This can lead to inaccurate medical records that may affect future diagnoses or treatment decisions. Because cardiac monitoring data is deeply personal, its exposure could also lead to privacy concerns beyond typical financial fraud.
What is the company doing?
In response to the breach, iRhythm Technologies notified the SEC and issued a public cybersecurity statement. This indicates that the company is taking steps to comply with regulatory disclosure requirements. However, specific remediation actions have not yet been shared publicly.
At this time, it is not known whether iRhythm is offering credit monitoring, identity protection services, or other assistance to affected individuals. No dedicated call center or breach response website has been announced so far. As a result, affected individuals currently have limited resources to turn to for personalized support.
Because the investigation appears to be ongoing, iRhythm may release additional information as it becomes available. The company has encouraged individuals who believe they may be affected to check its website for updates. Meanwhile, those concerned about their data should take proactive steps on their own while waiting for further communication.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Affected individuals should request copies of their credit reports and review them carefully for unfamiliar accounts or inquiries. You can obtain free credit reports from each of the three major credit bureaus. Checking these reports regularly makes it easier to catch fraudulent activity early.
Because identity thieves sometimes wait months before using stolen information, ongoing monitoring is important even if nothing looks wrong right away. In addition, consider setting up free account alerts with your bank and credit card issuers. This way, you’ll receive immediate notice of any suspicious transactions.
Consider a Fraud Alert or Credit Freeze
If Social Security numbers or financial account details were part of this breach, placing a fraud alert on your credit file is a smart precaution. A fraud alert requires lenders to verify your identity before approving new credit in your name. This extra step can stop identity thieves before they succeed.
For stronger protection, you can also place a credit freeze, which restricts access to your credit file entirely. Because a freeze blocks most new account applications, it offers one of the most effective defenses against identity theft. You can lift the freeze temporarily whenever you need to apply for credit yourself.
Protect Against Medical Identity Theft
Since health insurance information and medical records may have been exposed, it’s wise to review your medical statements and insurance explanation-of-benefits notices closely. Look for treatments or services you don’t recognize. If you spot anything unusual, contact your insurance provider immediately.
Medical identity theft can also affect your actual medical records if a thief receives treatment under your name. As a result, it’s important to request copies of your medical records periodically to confirm their accuracy. Correcting errors early can prevent complications with future healthcare decisions.
Stay Alert for Phishing Attempts
After a healthcare data breach, scammers often follow up with phishing emails or phone calls pretending to be from the breached company. Be cautious of unsolicited messages asking for personal information, login credentials, or payment. Legitimate companies rarely request sensitive details through unsolicited emails or texts.
Instead of clicking links in suspicious messages, go directly to the company’s official website or call a verified phone number. This simple habit can prevent you from accidentally handing over more information to criminals. If you’re ever unsure, it’s better to pause and verify before responding.
Consult a Data Breach Attorney
Given the sensitive nature of the data potentially involved, affected individuals may want to speak with a data breach attorney about their legal options. An attorney can help you understand whether you qualify for compensation through a class action or individual claim. Many offer free consultations to evaluate your situation.
Because breach investigations often reveal new details over time, consulting an attorney early can help you stay informed about deadlines and eligibility requirements. This proactive step ensures you don’t miss an opportunity to pursue compensation if it becomes available.