A voice on the phone knows you wore a heart monitor. It reads back your device serial number, your insurance number and the date your cardiologist ordered the test. Then it asks you to confirm a detail before your results can be released. Nothing in the call sounds wrong, because no stranger should know any of that. The iRhythm data breach is where a script like that comes from, and it reached at least 360,000 people.
Confirmation: confirmed by iRhythm, in a notice of data event updated on October 2, 2026 and in a June filing with the SEC.
What happened in the iRhythm data breach
iRhythm makes wearable cardiac monitors. Its Zio patch records your heartbeat for days at a time, then sends the trace to the company’s own analysts. So the company sits between you and your cardiologist, holding the record of a test you may not remember agreeing to share.
Attackers reached certain third-party business applications that stored iRhythm data. According to The Record, they got in through social engineering rather than a software flaw. They had access from June 3 to June 8, and iRhythm identified the intrusion on June 8.
The next day, the attackers wrote to the company. They threatened to publish what they had taken unless iRhythm paid. The company disclosed the incident to the SEC in June, then judged it material on June 10.
Then nothing public happened for nearly four months. iRhythm began notifying people on October 2, and filed with state regulators the week after that.
What the iRhythm data breach exposed
The company’s own notice lists the fields. They are patient name, address, email address, phone number, iRhythm patient account number, iRhythm device serial number, patient insurance number, date of service and date of birth.
No passwords appear on that list. Neither do card numbers, because iRhythm says it does not store individual financial account or payment card information. But the combination that is there is unusual, and it is worth taking each piece seriously.
- Insurance number. This is the one that pays. Medical identity theft bills your plan for care you never had, and the bill can surface years later.
- Date of service and device serial number. Together these prove the caller holds your record. That is exactly what a convincing impostor needs.
- Date of birth and address. These are the two things a call center asks to verify you.
- Email address. This is the delivery route for all of the above.
How many people, and why the number will grow
iRhythm has not published a total. The 360,000 figure comes from adding up state filings, so it is a floor rather than a count.
Texas filings cover 298,647 people. South Carolina filings cover another 69,526. California received a filing too, with no number attached, and the company told reporters it would not give the full figure. In short, more states means a larger number, and the states that have reported are not the biggest ones.
Why a health file is worth more than a password
A stolen password is cheap because you can change it. Your date of birth, your insurance number and the fact that you had a cardiac test are permanent. So the file keeps working for years after the breach that produced it.
iRhythm says it has no evidence that the information has been used to commit identity theft. That is a fair statement about today, and it is not a forecast. Meanwhile the data sits with somebody who asked to be paid for keeping it quiet.
What to do now
Most of what helps here has nothing to do with us.
- Treat a readback as worthless. Somebody who recites your serial number has proved they hold the file, not that they work for your clinic.
- Read your explanation-of-benefits statements. iRhythm points to this for a reason: a claim you do not recognize is the first sign of medical identity theft.
- Freeze your credit at all three bureaus. It is free, and it takes about ten minutes.
- Expect an email dressed as iRhythm or your cardiologist. Reach them by typing the address yourself, or by calling the number on your paperwork.
- Turn on the strongest sign-in your email account offers, which means a passkey or an authenticator app rather than text message codes.
How OptMsg changes this exposure
We should be careful here. This breach happened inside a healthcare vendor’s systems, and nothing on our side would have changed that.
What changes is what the leaked address can be used for afterward. Your OptMsg account has no password, so a password stolen from some other site cannot open your inbox — there is no password on it to match. Because your inbox is the reset route into most of your other accounts, an inbox that resists a stolen credential keeps that credential away from the rest of them.
Separately, mail from a sender you have not approved goes to Trash rather than your Inbox, and auto-deletes after 30 days. The follow-up message built from this file lands there.
Here is what the argument does not cover, stated plainly. It does nothing about a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. Our private always page lays out how we think about what an inbox should know about you.
Want an address a leaked password cannot open? Create your OptMsg account and pick your name while it is still free to choose.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: Was my password exposed in the iRhythm data breach? A: No. Passwords are not on the company’s list of affected fields, and iRhythm says it does not store payment card or financial account details either. If you reused a password anywhere, though, change it on general principle.
Q: Am I affected if I wore a Zio monitor? A: Not necessarily. iRhythm is notifying the people whose information was in the affected data and for whom it has contact details. Notifications began on October 2, so check your mail, and call the company’s line at 1-844-770-7175 if you are unsure.
Q: How many people were affected? A: At least 360,000, which is the total of the Texas and South Carolina state filings. iRhythm has declined to give a full figure, so the real number is higher.
Q: Why did it take four months to hear about it? A: iRhythm identified the intrusion on June 8 and disclosed it to the SEC that month. Individual notifications began on October 2. The company has not explained the gap.
Q: What is medical identity theft, and how would I spot it? A: It is somebody using your insurance details to get care or bill your plan. The signal is a claim on your explanation-of-benefits statement for treatment you did not receive.
Sources
- iRhythm, “Notice of Data Event,” updated October 2, 2026 — https://www.irhythmtech.com/us/en/who-we-are/news-events/notice-of-data-event
- SecurityWeek, “iRhythm Data Breach Impacts at Least 360,000 People,” October 12, 2026 — https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/
- The Record, “iRhythm says at least 360,000 affected in June cyberattack,” October 9, 2026 — https://therecord.media/irhythm-data-breach-reports
- SecurityWeek, “iRhythm Confirms Data Stolen in Hack,” June 2026 — https://www.securityweek.com/irhythm-confirms-data-stolen-in-hack/
Previous in Breach Breakdown: The Nippon Columbia Breach Turned 8.6 Million Karaoke Signups Into a Script
Next in Breach Breakdown: You Never Signed Up For Crunchbase. It Had Your Phone Number Anyway.
