iRhythmdata breachhealthcareSaaSsocial engineering

iRhythm: a patient data breach tied to third-party SaaS applications, and a figure that is still unclear

Name: CleanIssue
Price range: €€

Published on 2026-10-165 min readCleanIssue

> TL;DR: iRhythm, which makes the Zio wearable heart monitor, was breached between June 3 and June 8, 2026. The attacker reached business applications hosted by third parties and copied patient data. A payment was demanded in exchange for not publishing the data. The company has not published an official total: the 8.2 million figure comes from aggregated regulatory filings and reporting, and remains an estimate.

What happened

Access: the company says the intrusion relied on social engineering, not a technical flaw. The data was downloaded from business applications hosted by third-party providers.

Payment demand: in a June 10 SEC filing, iRhythm says it received a demand for an undisclosed payment in exchange for not publicly releasing the data. It is unknown whether anything was paid.

Data involved: names, addresses, email addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth.

Numbers: state filings published in October list 298,647 people in Texas and 69,526 in South Carolina. The "at least 370,000 patients" figure comes from these filings. The 8.2 million figure is an aggregate of regulatory filings and press reports. iRhythm only says the number "is reflected in our required regulatory filings."

Clinical impact: according to the company, devices, patient safety and clinical operations are not affected.

The part that applies to everyone

The first weak point was not the company's core system but the SaaS chain around it. A business application holding patient data, hosted by a third party, becomes the weak link. The attacker did not need to break the core product: they followed the access granted to the tools around it.

What to check in your own setup

Inventory every SaaS application that stores personal data, including those run by a provider. Who administers them, and with which rights?

Audit provider access: shared accounts, forgotten administrator accounts, bulk exports that trigger no alert.

Treat social engineering as a technical vector: verify password reset and access requests, and require phishing-resistant MFA for business applications.

Prepare notification now: know which data, what volumes and which jurisdictions are involved, before a regulator asks.

The takeaway

A breach does not necessarily start with the main product. Here the product is a well-protected medical device. The door opened on the tools around it, and that is where to look first.

Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

Three adjacent analyses to keep exploring the same attack surface.

Famous hacksFrance

DGFiP Breached by ZeroBytes: Inside France's Biggest Tax Data Leak of 2026

France's tax authority (DGFiP) confirmed unauthorized access to its information system: impersonated agent credentials, no blanket MFA, and over 2 million people potentially exposed through the cadastral records server.

2026-08-20 · 7 min read

Data breachIDOR

ANTS / France Titres 2026: a basic IDOR flaw exposes 11.7 million accounts

France's vehicle registration and ID portal ants.gouv.fr was compromised through an elementary IDOR vulnerability: changing an identifier in an API request was enough to access other users' data. Official tally: 11.7 million accounts exposed, with the attacker claiming up to 19 million.

2026-09-03 · 6 min read

CNILcompliance

CNIL priority sectors 2026: healthcare, finance, justice in focus

CNIL targets healthcare, finance and justice for 2026 controls. How to prepare.

2026-04-02 · 5 min read

Sources

Written by CleanIssue

Reviewed on 2026-10-16

Related services

If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

Custom Red Team

Several agents, MCP servers or agents delivered by an agency: on quote.

Agent Red Team Express

Find out quickly what a stranger can make your agent do. Report in 5 days.

The Shield

Software that will block unauthorized actions. In development, early access for first customers.