[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8z67A7iRcgAb6jfYndYwVPZrERdE27VvlLK7MW2poV4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"b65882ab-2054-4f3f-91eb-19b95de748ef","irhythm-breach-third-party-app-risk-exposes-360000-patients","0b5da2ae-6f07-40de-9453-d71ebe3eec0e","iRhythm Breach: Third-Party App Risk Exposes 360,000 Patients","Hackers accessed and exfiltrated sensitive patient data from third-party-hosted business applications used by iRhythm, a medical device company, over a five-day window in June. The root issue lies in insufficient oversight of third-party vendors and the applications they host, which created a blind spot in iRhythm's security perimeter. In healthcare, where patient data carries heightened regulatory and ethical sensitivity, third-party risk is especially dangerous because breached data can enable identity theft, insurance fraud, and targeted phishing. This incident underscores that organizations are only as secure as their weakest external dependency — and that vendor-hosted environments require the same rigorous controls as internal systems.","**Immediate actions:**\n- Conduct an emergency audit of all third-party-hosted applications to verify current access controls and patch levels.\n- Force credential rotation and review session tokens for any accounts connected to the affected third-party applications.\n- Engage the third-party vendors involved to obtain full incident reports and confirm the breach vector has been closed.\n\n**Long-term improvements:**\n- Enforce contractual security requirements (e.g., SOC 2, HITRUST) for all vendors handling protected health information (PHI).\n- Implement a formal Third-Party Risk Management (TPRM) program with periodic security assessments and right-to-audit clauses.\n- Apply the principle of least privilege to all third-party application integrations, limiting vendor access to only the data strictly necessary.\n\n**Detection measures:**\n- Deploy Data Loss Prevention (DLP) tools and behavioral analytics to detect abnormal data exfiltration from third-party-hosted environments.\n- Establish continuous monitoring and alerting for unusual access patterns or bulk data queries against applications containing PHI.\n- Require vendors to provide real-time security event logs to your SIEM so that cross-environment threats can be correlated quickly.",[12,13,14,15,16,17,18,19,20,21,22],"NIST SP 800-161 (Supply Chain Risk Management)","NIST CSF PR.AC-3 (Remote Access Management)","NIST CSF DE.CM-6 (External Service Provider Monitoring)","CIS Control 15 (Service Provider Management)","CIS Control 3 (Data Protection)","CIS Control 6 (Access Control Management)","HIPAA §164.308(a)(1) (Security Risk Analysis)","HIPAA §164.308(b)(1) (Business Associate Contracts)","GDPR Article 28 (Processor Obligations)","GDPR Article 32 (Security of Processing)","HITRUST CSF Control Category 09.ab (Monitoring System Use)",{},"published","2026-10-12T12:21:39.041377+00:00","2026-10-12T12:21:39.014+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.securityweek.com\u002Firhythm-data-breach-impacts-over-360000-people\u002F","irhythm-data-breach-impacts-at-least-360-000-people-7efaee","iRhythm Data Breach Impacts at Least 360,000 People",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":57,"name":58,"problem":59},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":61,"name":62,"problem":63},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]