8.2 Million Patients Caught in iRhythm Data Breach That Exposed Insurance Info

If you used an iRhythm heart monitor, including a Zio device, the information tied to your care could now be in someone else’s hands. That includes details that can help scammers sound like they know your medical history.

The HHS Office for Civil Rights breach portal listed the iRhythm incident as affecting 8,179,772 individuals, reported Oct. 29, 2026.^[1] iRhythm disclosed in a Form 8-K dated June 10, 2026, that it had determined the cybersecurity incident was material because of the volume of potentially affected data.^[2]

The stolen information included names, addresses, dates of birth, email addresses, phone numbers, iRhythm account numbers, device serial numbers, patient insurance numbers, and dates of service.

iRhythm said it has no evidence that personal information has been or will be used to commit identity theft, and it encouraged affected people to protect themselves against medical identity theft and identity fraud. Here’s what changed, what it means, and what steps to take.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What happened in the iRhythm data breach

In its Form 8-K filed with the SEC, iRhythm said it identified unauthorized activity June 8, 2026, involving data maintained on certain third-party-hosted business applications. The company said the affected data was obtained through social engineering and that certain data was exfiltrated from those applications.

A day later, on June 9, iRhythm received communications from a threat actor claiming to have obtained sensitive information, including proprietary data, patient protected health information, and other personal information. The threat actor demanded payment in exchange for not publicly disclosing the information.

In an Oct. 2 company update carried by Nasdaq, iRhythm said unauthorized individuals accessed and downloaded certain data between June 3 and June 8, 2026, and that it had begun notifying impacted individuals.

The California Attorney General’s breach list shows an iRhythm Technologies Inc. breach with incident dates of June 3 and June 8, 2026, and a posted date of Oct. 6, 2026.

According to iRhythm’s Oct. 2 update, the compromised patient information included:

• Names
• Addresses
• Dates of birth
• Email addresses
• Phone numbers
• iRhythm patient account numbers
• iRhythm device serial numbers
• Patient insurance numbers
• Dates of service

The company said the incident didn’t involve its products, clinical or medical device systems, connections to customers, manufacturing and distribution operations, patient safety, or its ability to meet patient needs. It also said it doesn't store or retain individual financial account information or payment card information.

The threat actor has not been publicly named in the company’s SEC filing.

What this means for iRhythm patients

This breach is risky because the stolen data connects your identity, your contact information, your insurance information, and your cardiac monitoring details. A scammer doesn't need your full medical chart to sound convincing. A name, date of service, device reference, and insurance number can make a fake call or email look legitimate.

Your patient insurance number is especially sensitive. Criminals might try to use medical or insurance details to submit fraudulent claims, impersonate a provider, or trick you into giving up more information. Dates of birth and addresses also help criminals pass identity checks or build a more complete profile about you.

The risk can last well beyond the notification letter. You can change an email password, but your date of birth, past dates of service, and device history aren't easy to replace. Treat unexpected messages about your iRhythm account, Zio device, insurance, or old cardiac monitoring services with extra caution.

iRhythm’s notice didn't mention free identity theft or credit monitoring services. That makes it more important to set up your own checks and watch your insurance records closely.

What to do right now after the iRhythm data breach

Start with your notice letter, then lock down the areas the stolen data could affect.

1. Read your iRhythm notice carefully. Confirm whether the notice says your information was involved, what data types were listed, and whether iRhythm gives any contact instructions. Keep the letter in case you need it for an insurer, provider, or identity theft report later.
2. Watch your health insurance records. Review explanation of benefits statements, mailed notices, portal activity, and claims history for services you didn’t receive. If you see a mystery claim, call your insurer using the number on your insurance card, not a number from a suspicious message.
3. Be ready for targeted phishing. Scammers might reference iRhythm, Zio, your device, an insurance issue, or a past date of service to get you to click a link or share more data. Learn how to spot a phishing email, and don't give out your insurance number, login code, or date of birth in response to an unexpected call, text, or email.
4. Consider freezing your credit. iRhythm said it doesn't store or retain individual financial account or payment card information, but exposed birth dates, addresses, and contact details can still support broader identity scams. A credit freeze is free and can help block new credit accounts opened in your name.
5. Use extra monitoring if you're worried about identity theft. Because iRhythm’s notice reportedly didn't mention free monitoring, you might want to use your own identity theft protection or credit monitoring, especially if your insurance number and date of birth were exposed.
6. Reduce scam fuel where you can. Exposed addresses, emails, and phone numbers can increase spam and impersonation attempts. A data removal service can help reduce how much of your contact information is easy to find through people-search sites and data brokers.

Bottom line

The iRhythm update puts the breach at 8,179,772 affected people, with patient insurance numbers, device serial numbers, account numbers, service dates, birth dates, and contact details exposed.

Check your iRhythm notice, monitor your insurance records, and be skeptical of any message that references your heart monitor or account details. There's no reported free monitoring offer in the notices covered by SecurityWeek, so take your own protective steps now.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

See Price

On Aura Identity Theft's website

2026 Editors’ Choice

Best Overall Identity Theft Protection Service

Identity Protection

Aura Identity Theft

• ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
• Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
• Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription

Author Details

Kalleigh Lane

About the Author

Kalleigh Lane is the Managing Editor at All About Cookies, where she helped develop the site's star rating system for product reviews and specializes in testing VPNs, ad blockers, and parental controls on Android and PC. She brings more than five years of experience editing and writing across cybersecurity, tech, and finance, and she has authored and edited over 300 articles for All About Cookies. Before joining AAC, she worked as a journalist and editor at CTV News and the Globe and Mail, and she holds a Master of Arts in English Literature from the University of Toronto.