iRhythm reports data taken from third-party hosted business applications through social engineering

iRhythm Holdings, which makes wearable heart monitors, disclosed on June 15, 2026 that data had been taken from certain third-party hosted business applications it uses. The company identified the activity on June 8, received an extortion message on June 9, and decided the incident was material on June 10 because of the volume of data.

What iRhythm said

The next day a threat actor claimed to have proprietary data, patient health information and other personal information, and demanded payment. iRhythm confirmed exfiltration and gave the route.

The company stressed what was not involved: its products, clinical and medical device systems, patient safety, manufacturing, distribution and financial reporting. It did not expect a material financial effect.

Open questions

iRhythm did not name the hosted applications, the number of people affected, or whether it responded to the demand. It said it would amend the filing as required information became available.