HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million

What happened

The company, which specializes in wearable cardiac monitoring technology and is best known for its Zio wearable ECG monitor, disclosed the incident in mid-June. Earlier this month, the company started sending notification letters to the potentially affected individuals and filed notices with regulators in several states, as well as with the US Department of Health and Human Services (HHS).

Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications.

Data Breaches Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications. iRhythm said right from the start that sensitive information might have been stolen from certain third-party-hosted business applications and that the hackers attempted to extort a ransom, threatening to leak the compromised data.

The incident has now been listed on the HHS data breach portal as affecting 8,179,772 individuals, a number iRhythm previously reported to the Oregon Attorney General’s office. Per iRhythm’s previous notices, the hackers compromised patients’ names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data (including account/serial/insurance numbers and dates of service).

“iRhythm has no evidence that any personal information has been or will be used to commit identity theft,” the company said earlier this month. It also encouraged potentially affected individuals to protect themselves against medical identity theft and identity fraud, but its notice does not mention free identity theft or credit monitoring services.