iRhythm 2026 Third-Party Application Breach
The 2026 iRhythm data breach concerns a social-engineering incident affecting data in certain third-party-hosted business applications.
The organization has not published how many were affected, so the incident cannot be placed on this scale.
Exposed Data Types
1 sensitive3- Protected health information under review
- Internal corporate data
- Personal information under review
About This Breach
According to the company's Form 8-K filed with the SEC, iRhythm identified unauthorized activity on 8 June 2026 and activated its response plan. On 9 June, a threat actor claimed to have obtained proprietary data, patient protected health information, and other personal information and demanded payment in exchange for not publishing it. The company confirmed that certain data was exfiltrated from the applications.
iRhythm determined on 10 June that the incident was material because of the volume of potentially affected data. At the filing date, the number of affected individuals, data volume, and detailed categories remained under investigation, so no undisclosed person count is estimated. The structured fields reflect only the three high-level groups in the SEC filing: internal or proprietary corporate data, protected health information under review, and other personal information under review.
Systems reported as unaffected
The SEC filing and company statement say no impact had been identified to products; clinical or medical-device systems; customer connections; patient safety; manufacturing and distribution operations; financial-reporting systems; or the ability to meet patient needs. The company said it does not store individual financial-account or payment-card information and had found no evidence of ongoing unauthorized access at the filing date. Those were the investigation's findings at that time, not a claim that every data category was final.
Scope and safe response
Production has no import job or locally held person-level dataset linked to this breach; pwnCount and totalRecords remain empty instead of substituting an undisclosed figure. Direct recipients should rely on the fields in their own notices and verify unexpected data or payment requests made in iRhythm's name through known company channels. The disclosed incident alone does not establish that a device, clinical service, or particular patient's data was affected.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
