iRhythm Data Breach Impacts at Least 360,000 People
iRhythm data breach exposes personal information of over 360,000 patients.
Run iRhythm?
Get an email when a reviewed story names iRhythm, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Medical device company iRhythm is notifying over 360,000 individuals about a data breach that occurred between June 3 and June 8. Hackers accessed and exfiltrated patient data, including names, addresses, dates of birth, and phone numbers, from third-party-hosted business applications. The company has no evidence the data has been misused for identity theft, and stated the incident does not impact products, clinical systems, or patient safety.
The lesson from this incident
Full lessonHackers accessed and exfiltrated sensitive patient data from third-party-hosted business applications used by iRhythm, a medical device company, over a five-day window in June. The root issue lies in insufficient oversight of third-party vendors and the applications they host, which created a blind spot in iRhythm's security perimeter. In healthcare, where patient data carries heightened regulatory and ethical sensitivity, third-party risk is especially dangerous because breached data can enable identity theft, insurance fraud, and targeted phishing. This incident underscores that organizations are only as secure as their weakest external dependency — and that vendor-hosted environments require the same rigorous controls as internal systems.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.