Did iRhythm Pay Ransom After Hackers Stole 360,000 Patient Records From Third-Party Apps?
Hackers exfiltrated patient records from third-party apps. iRhythm says no identity theft evidence exists, suggesting a possible ransom payment.
Key points
- Hackers stole data from 360,000+ patients between June 3 and June 8.
- iRhythm reports no evidence of identity theft, implying a ransom payment.
- The breach affected third-party-hosted business applications, not core medical devices.
Hackers compromised third-party-hosted business applications used by digital healthcare provider iRhythm, stealing personal information from more than 360,000 patients. The company identified the breach on June 8, according to SecurityWeek. Attackers accessed and exfiltrated data from these external systems between June 3 and June 8.
Root cause
The incident involved third-party-hosted business applications that stored specific iRhythm information. These systems held sensitive patient details, including names, addresses, email addresses, dates of birth, and phone numbers. The compromise did not involve iRhythm’s core clinical or medical device systems, nor did it impact manufacturing, distribution, or patient safety operations, the company stated.
Attack path
Threat actors accessed the affected applications over a five-day window in early June. On June 9, hackers contacted iRhythm, demanding a ransom payment in exchange for not leaking the stolen information online, according to a Securities and Exchange Commission filing. The attackers threatened public disclosure of the stolen information.
Affected versions
The breach impacted data stored in specific third-party-hosted business applications. There are no specific software versions or CVE identifiers cited in the reports. Based on regulatory notices filed last week, at least 360,000 individuals were affected, with 298,647 in Texas and 69,526 in South Carolina. The total number of impacted patients is likely higher than this confirmed count.
Mitigation
iRhythm has not confirmed the existence of a patch or technical fix for this incident. The company stated it has no evidence that the stolen information has been or will be used to commit identity theft. This lack of reported misuse suggests the organization may have paid the ransom to prevent data leaks, though this remains unconfirmed.
What to do and how to stay safe: iRhythm
- Monitor credit reports and bank statements for unusual activity, as personal identifiers were stolen.
- Enable multi-factor authentication on all personal and professional accounts to reduce credential reuse risks.
- Watch for phishing emails referencing iRhythm or medical services, as attackers may use leaked data for social engineering.
- Freeze your credit with major bureaus to prevent new accounts from being opened in your name.
Step-by-step guide: Data Breaches Explained: How to Spot the Leak Before It Hurts
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was stolen in the iRhythm breach?
Hackers stole names, addresses, email addresses, dates of birth, phone numbers, account numbers, serial numbers, insurance numbers, and dates of service.
Did the breach affect iRhythm’s medical devices or patient safety?
No, the company stated there was no impact to products, clinical systems, manufacturing, or patient safety.
How many people were affected by the data breach?
At least 360,000 individuals were affected, with confirmed counts in Texas and South Carolina, but the total is likely higher.
