iRhythm Breach Exposes Patient and Proprietary Data After Social Engineering Attack

iRhythm Holdings disclosed a material cybersecurity incident after attackers used social engineering to access certain third-party-hosted business applications and exfiltrate sensitive data. According to the company’s SEC filing, unauthorized activity was identified on June 8, and on June 9 a threat actor contacted iRhythm claiming to possess proprietary company information, patient protected health information, and other personal data, while demanding payment to stop the information from being publicly released.

The company said the intrusion was confined to third-party business applications and that there is no evidence its products, clinical or medical device systems, customer connections, patient safety, manufacturing and distribution operations, or financial reporting systems were affected. iRhythm has not named a responsible group or disclosed how many individuals were impacted, and said it is still investigating with external cybersecurity experts whether the attacker’s claims fully match the data stolen; it also stated that payment card and financial account information were not involved and that it has not found evidence of ongoing unauthorized access.