Loading story…
Medical device maker iRhythm disclosed a cyberattack that exposed information belonging to at least 360,000 people. Attackers used social engineering to access third-party-hosted business applications between June 3 and June 8, 2026, and downloaded patient information, including identifying details, insurance numbers, account numbers, and device serial numbers. A threat actor demanded payment to prevent publication of allegedly stolen proprietary data, protected health information, and other personal information. iRhythm confirmed data exfiltration, but no hacking group has publicly claimed responsibility.
The company notified affected individuals and regulators, with a consumer notification letter published through South Carolina’s Department of Consumer Affairs on October 6. iRhythm reported no impact on clinical systems, medical devices, manufacturing, distribution, or service delivery, and said it had found no evidence of identity theft involving the stolen information. The incident underscores the exposure of sensitive healthcare data through third-party business applications even when clinical operations remain unaffected; security teams should review social-engineering defenses and access controls across those applications.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
After verifying the breach's scope, iRhythm notified affected individuals and applicable regulators, reporting 298,647 affected people in Texas and 69,526 in South Carolina. The company also filed notices in California but declined to provide the total number affected.
In a June Form 8-K filing, iRhythm disclosed the threat actor's communications and confirmed that data had been exfiltrated from affected applications. The company said the incident did not affect clinical systems, medical devices, or operations, including manufacturing and distribution.
A threat actor contacted iRhythm claiming to possess proprietary data, patient protected health information, and other personal information. The actor demanded payment in exchange for not publicly disclosing the information.
Attackers used social engineering to access third-party-hosted iRhythm business applications between June 3 and June 8 and downloaded patient information. The stolen data included identifying details, dates of service, patient account numbers, device serial numbers, and insurance numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
iRhythm Holdings disclosed a material cybersecurity incident after attackers used social engineering to access certain third-party-hosted business applications and exfiltrate sensitive data. According to the company’s SEC filing, unauthorized activity was identified on June 8, and on June 9 a threat actor contacted iRhythm claiming to possess proprietary company information, patient **protected health information**, and other personal data, while demanding payment to stop the information from being publicly released. The company said the intrusion was confined to third-party business applications and that there is no evidence its products, clinical or medical device systems, customer connections, patient safety, manufacturing and distribution operations, or financial reporting systems were affected. iRhythm has not named a responsible group or disclosed how many individuals were impacted, and said it is still investigating with external cybersecurity experts whether the attacker’s claims fully match the data stolen; it also stated that payment card and financial account information were not involved and that it has not found evidence of ongoing unauthorized access.
Jun 29, 2026
Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to **3,834,294 individuals**. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the **ShinyHunters** extortion group, which claimed to have stolen about **9 million records** and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information. Medtronic said it found **no impact** on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering **24 months** of credit monitoring, dark web monitoring, and identity theft recovery services.
Jul 8, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026