iRhythm Holdings, a California-based maker of heart monitors, is warning more than eight million people that hackers stole personal and health information.
The U.S. Department of Health and Human Services breach portal lists 8,179,772 people as affected. iRhythm said unauthorized individuals accessed and downloaded data from certain third-party-hosted business applications between June 3 and June 8.
The company said it detected unauthorized access on or around June 8, 2026, and implemented its incident response plan. It said it worked with external cybersecurity professionals and completed a forensic investigation, which found that certain stored data was accessed and downloaded during that period.
What information was exposed
The stolen data includes patient names, addresses, email addresses, phone numbers, dates of birth, iRhythm account numbers, device serial numbers, insurance numbers and dates of service.
iRhythm began notifying impacted people on October 2. The company said it has no evidence that any personal information has been or will be used to commit identity theft. It is encouraging affected individuals to place a fraud alert or security freeze on their credit files and to obtain free credit reports.
Devices and systems not affected, company says
iRhythm said its medical devices, clinical systems and patient safety were not affected. It also said it does not store payment card or financial account information.
State filings previously showed more than 368,000 people impacted in Texas and South Carolina. The San Francisco company is best known for its Zio wearable heart monitor.
