iRhythm Discloses Patient Data Breach After Social Engineering Attack: What Was Exposed & What To Do
iRhythm Holdings disclosed a patient data breach on June 16, 2026, after a social engineering attack exposed personal information, protected health information, and proprietary data of an undisclosed number of people. Individuals who may have been affected should review any notices from the company and take steps to protect their information.
Inside the incident
iRhythm Holdings stated that attackers gained entry to third-party business applications through social engineering. The intrusion allowed the theft of personal information, protected health information, and proprietary data. The company reported no signs that the event affected medical devices, patient safety, or ongoing operations. The disclosure was submitted to the Securities and Exchange Commission.
How a breach like this happens
Social engineering incidents often begin with an attacker contacting an employee or contractor and obtaining credentials or approval to access internal systems under false pretenses. Once inside, the intruder can reach connected third-party applications that store or process sensitive records. Such access frequently occurs without immediate detection, allowing data to be copied before the organization identifies unusual activity.
Who is iRhythm Holdings?
iRhythm Holdings operates in the digital healthcare sector and provides analysis of cardiac data collected from patients. The company has processed information from more than 12 million individuals. Organizations in this field routinely maintain records that combine personal identifiers with clinical details, making them targets for data theft that can later be used for fraud or sold on illicit markets.
What was likely exposed
The company has confirmed that personal information, protected health information, and proprietary data were accessed. The precise categories of information within those broad headings have not been disclosed. Healthcare firms of this type commonly store names, contact details, dates of birth, insurance information, and clinical notes; however, the exact contents taken in this case remain unconfirmed.
What's at stake
Individuals whose records were accessed may encounter risks of identity theft or misuse of their medical information for fraudulent claims. The organization faces regulatory scrutiny and potential costs associated with notification and remediation. No evidence has been presented that the stolen data has been further distributed or used in additional attacks.
What to do if you're exposed
Review any notifications sent by iRhythm Holdings and consider placing a fraud alert with credit reporting agencies. Monitor financial and insurance statements for unusual activity. Individuals can also run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
West Pharmaceutical Services Hit by RansomwareStryker Hit by Unprecedented 12-Petabyte Data Wipe Listed by handala Ransomware GroupAdaptHealth Patient Data Stolen via Contractor PhishingOncology Institute Confirms Patient Data Impacted by Vendor BreachLatest breaches
Verified breach
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.