iRhythm Technologies, a San Francisco-based heart monitor maker, experienced a cybersecurity incident involving unauthorized access to third-party-hosted business applications between June 3 and June 8, 2026. The company detected the access around June 8, 2026, and disclosed the incident in an SEC Form 8-K on June 10, 2026. iRhythm began notifying affected individuals on October 2, 2026.
The exposed data included patient names, contact details, account numbers, insurance numbers, device serial numbers, service dates, and dates of birth. iRhythm stated that it does not store individual financial-account or payment-card information, and these were not involved. The company reported no evidence that the information had been or would be used for identity theft. A Texas report lists 298,647 affected Texans; however, the total number of affected individuals has not been publicly confirmed.
Details can continue to emerge as investigations progress and regulatory filings are made. Notices to consumers may be delayed, and additional information may be disclosed by iRhythm or regulatory bodies at a later date.