iRhythm data breach (June 2026): what iRhythm told the SEC
In June 2026 iRhythm Technologies, maker of the Zio heart monitor, disclosed that patient data on third-party-hosted business applications had been taken. Its SOC 2 report covers the Zio service.
Short answer
Was iRhythm hacked?
Yes. iRhythm’s Form 8-K says it found unauthorized activity involving data on “certain third-party-hosted business applications” on 8 June 2026, that the data was obtained through social engineering, and that a threat actor demanded payment. It says clinical and device systems were not affected.
Reporting of iRhythm’s Oregon DOJ filing puts the number of people at 8,179,772; iRhythm has not published a total.
Timeline at a glance
8 Jun 2026Unauthorized activity found on third-party-hosted business applications. (BankInfoSecurity)Confirmed
Oct 2026Oregon DOJ filing reported at 8,179,772 people. (Paubox)Reported
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
iRhythm Technologies’s security posture at the time
What iRhythm Technologies publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
SOC 2SOC 2 Type IIScope: Zio by iRhythm (Security, Availability, Confidentiality and Privacy criteria).Source: iRhythm Trust Center — Security
FIPS 140FIPS 140-2 validation (certificate #3118)Scope: Data encryption in Zio by iRhythm.Source: iRhythm Trust Center — Security
Scope vs breach. The published certificate scope covers a different part of the business from the system that was breached. The SOC 2 report covers the Zio service; the breach involved third-party-hosted business applications.
No reliable report of a share-price move around the disclosure was found.
iRhythm Technologies incident timeline, in detail
Confirmed = acknowledged by iRhythm Technologies, a regulator filing or a court. Reported = credible reporting iRhythm Technologies has not fully confirmed. Unverified claim = an attacker or leak-site claim.
15 Jun 2026 (found 8 Jun)ConfirmedIdentity / third-party SaaS
Social engineering exposes patient data in third-party-hosted apps
What happened. iRhythm told the SEC it found unauthorized activity involving data on “certain third-party-hosted business applications” on 8 June 2026, that the data was obtained through social engineering, and that a threat actor demanded payment. It says clinical and device systems were not affected.
Impact. Patient data taken; ransom demanded. People or records affected: 8,179,772 people, per iRhythm’s Oregon DOJ filing as reported by Paubox; iRhythm has not published a total.
iRhythm Technologies publicly held SOC 2. Stated scope: Zio by iRhythm (Security, Availability, Confidentiality and Privacy criteria). Data encryption in Zio by iRhythm. The published scope covers a different part of the business from the system that was breached.
A third party held the data
The data sat on a platform run by, or bought from, someone else. A company’s own certificate rarely covers its suppliers; vendor due diligence, contract terms and the supplier’s own assurance are what apply.
What it means for iRhythm Technologies patients, clinics and payers using Zio — and what to do
What iRhythm Technologies’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Find out whose vendor it was
Ask which supplier was involved, what data of yours it held, and whether your contract gives you notification and audit rights.
Yes. iRhythm’s Form 8-K says it found unauthorized activity involving data on “certain third-party-hosted business applications” on 8 June 2026, that the data was obtained through social engineering, and that a threat actor demanded payment. It says clinical and device systems were not affected.
Did iRhythm Technologies have SOC 2 or ISO 27001 certification?+
iRhythm Technologies publicly held SOC 2. Stated scope: Zio by iRhythm (Security, Availability, Confidentiality and Privacy criteria). Data encryption in Zio by iRhythm. The published scope covers a different part of the business from the system that was breached.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by iRhythm Technologies. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout