iRhythm Technologies, a California-based manufacturer of wearable heart monitors, disclosed a significant data breach affecting more than 368,000 patients across multiple states.
Unauthorized individuals accessed and downloaded data from certain third-party-hosted business applications between June 3rd and June 8th, according to the company. State filings indicate 298,647 people were impacted in Texas and 69,526 in South Carolina, though the company has not disclosed a nationwide total.
The stolen records include patient names, addresses, email addresses, phone numbers, dates of birth, iRhythm account numbers, device serial numbers, insurance numbers, and dates of service.
According to an SEC filing from June, the data breach occurred through social engineering tactics. A threat actor contacted the company on June 9th claiming to possess patient health information and proprietary data, demanding payment in exchange for not publicly disclosing the information.
iRhythm began notifying impacted patients on October 2nd. The company stated it has no evidence that personal information has been or will be used to commit identity theft. iRhythm also confirmed that its medical devices, clinical systems, and patient safety were not affected by the breach, and noted it does not store payment card or financial account information.
iRhythm manufactures the Zio patch, a wearable sensor used for long-term heart rhythm monitoring.
