The Record reported on 9 October that iRhythm, which makes the Zio Patch heart monitor, has told regulators that a June cyberattack hit at least 360,000 people. The company said hackers had access between June 3 and June 8. They got in through a social engineering attack, meaning they tricked someone into giving access. They reached business applications hosted by third parties. iRhythm reported 298,647 affected people in Texas and 69,526 in South Carolina. It also filed a notice in California. The company said the stolen data included names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service and birth dates.
Some facts remain open. A company spokesperson declined to give the full number of victims. The California figure was not reported. The third-party applications were not named. No hacking group has publicly claimed the attack. iRhythm said it has no evidence the data has been or will be used for identity theft. In a June filing with the US Securities and Exchange Commission, iRhythm said a threat actor demanded payment to keep the data private. The company did not say in the material reported whether it paid. It said clinical systems, devices and operations were not affected.
The Record notes that dozens of medical device makers have had security incidents over the past two years. This case shows that data held in outside business tools can be stolen even when core systems are untouched. Teams that run or buy such software may want to know which third-party apps hold patient or customer data.