iRhythm Holdings, the US maker of the Zio wearable cardiac monitor, said on 2 October 2026 that its forensic investigation into the June incident was complete and that it had begun notifying affected individuals. The company detected unauthorised access to certain third-party-hosted business applications on or around 8 June 2026, and found that data was accessed and downloaded between 3 and 8 June.

In its 15 June Form 8-K, iRhythm said the access was obtained through social engineering. A threat actor contacted the company on 9 June, claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it. The exposed fields are patient name, address, email, phone, date of birth, iRhythm patient account number, device serial number, insurance number and date of service. iRhythm says it holds no financial account or payment card data, and that products, clinical and medical-device systems, manufacturing and patient safety were not affected.

The Record (9 Oct) reports breach notices covering 298,647 people in Texas and another 69,526 in South Carolina, and that iRhythm also filed breach notices in California.

No group has publicly claimed the attack. iRhythm has not said whether it paid. Primary: iRhythm update (2 Oct, GlobeNewswire) and SEC Form 8-K (15 Jun); wire: The Record (9 Oct).

Correction (23 Oct 2026): this card earlier credited the state-filing figures to two outlets (12 Oct) and added them together; they are now credited to The Record (9 Oct) and are not combined.

UPDATE (23 Oct 2026): Oregon's Department of Justice breach database lists an iRhythm Technologies Inc. entry with 8,179,772 as the number affected, reported on 6 October 2026, giving 3 to 8 June 2026 as the dates of breach (the entry also shows a placeholder date of 1/1/0001), 8 June 2026 as the date of discovery and 2 October 2026 as the date notice was sent.

The database says its entries show the information in an organisation's initial breach report and do not reflect later updates to affected numbers.