HHS Lists 8.2 Million People Affected by iRhythm Breach

The US Department of Health and Human Services (HHS) has updated the data-breach tally for iRhythm Technologies, after the medical equipment maker disclosed a June 2026 incident. The HHS breach portal lists 8,179,772 affected individuals, a figure iRhythm had previously reported to state regulators and to the Oregon Attorney General. The breach's impact centrepiece remains third‑party hosted business applications used by iRhythm, with attackers compromising those systems and exfiltrating sensitive information.

According to iRhythm’s notices, the data stolen includes patients’ names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data—encompassing account numbers, serial numbers, insurance details, and dates of service. iRhythm said there is no evidence that any personal information has been or will be used to commit identity theft, and asserted there has been no identified impact on its products, clinical or medical device systems, customer connections, manufacturing or distribution operations, patient safety, or the company’s ability to meet patient needs.

The company also confirmed that hackers attempted to extort a ransom by threatening to leak the compromised data, and began sending notification letters to potentially affected individuals while filing regulatory notices.