iRhythm notifies at least 360,000 patients after a social engineering breach of hosted apps

The two state filings already exceed the company's floor of 360,000 ^[1]. The Texas and South Carolina notices alone total 368,173 people ^[20], and that is before any count from California, where iRhythm also filed ^[6]. A company spokesperson declined to give the full number, telling Recorded Future News that iRhythm "responded promptly after detecting the unauthorized access and, once the scope was verified, notified affected individuals and applicable regulators." ^[7]

During the intrusion, iRhythm says, the attackers accessed and downloaded the data ^[12]. Its June 8-K said the company "received communications from a threat actor claiming to have obtained sensitive information, including proprietary data, patient protected health information and other personal information." ^[15] "Since receipt of the communications, the Company has confirmed that certain data was exfiltrated from those applications," iRhythm said ^[17].

iRhythm's best-known product is the Zio Patch, a chest-worn sensor for long-term cardiac monitoring and arrhythmia detection ^[3]. "The incident did not affect iRhythm clinical systems or medical devices and did not result in a loss of service or disruption to operations," the spokesperson said ^[8]. The company says products, manufacturing and distribution were untouched and its finances were not disturbed. It reported $224.2 million in Q2 revenue ^[14]. The patient records were held somewhere else, in business applications hosted by a third party ^[10].

Disclosure came in two stages. Investors read about the extortion claim in the June 8-K ^[15]. Patients and state regulators are getting counts and letters through notices iRhythm began filing this week, according to The Record ^[2]. The applications and their host have not been named ^[10]. On the current record, the attackers got in by social engineering their way into access to those applications ^[10].

The Record counts dozens of medical device makers hit over the last two years, in incidents that reached business and manufacturing systems ^[18]. It lists Medtronic, Boston Scientific, Stryker, UFP, Masimo, Surmodics, Artivion and Zoll among those whose attacks leaked data on millions and caused supply chain problems ^[19]. No group has publicly claimed the iRhythm attack ^[13]. With operations intact, the only pressure on iRhythm was the stolen data ^[14][16]. The company says it has "no evidence that any personal information has been or will be used to commit identity theft." ^[21]