iRhythm Confirms Data Stolen in Cyberattack, Ransom Demanded
Digital health company iRhythm Holdings confirmed a cyberattack involving certain third-party-hosted business applications. The company learned of the breach on June 8, 2026, which resulted in the theft of patient protected health information, proprietary data, and other personal data. Attackers subsequently demanded a ransom.
Irhythmtech
- Domain
- irhythmtech.com
- Sector
- Health Care and Social Assistance
- Signals
- 1 linked
Signal context
First seen: Jun 8, 2026
Last updated: Jun 25, 2026
Status: Public signal
Key points
- iRhythm Holdings discovered unauthorized activity on June 8, 2026.
- Patient protected health information, proprietary data, and personal data were stolen.
- Attackers demanded a ransom.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Health Care and Social Assistance
Likely country: 🇬🇧 United Kingdom
inferred from source domains
Watch internet-facing systems, credential abuse and exploit activity.
- Source type: outside the affected organization
Impact area: Confidentiality
Likely asset: User or customer data
- 12 signals in the same sector
- 93 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
iRhythm Confirms Data Stolen in Hack - SecurityWeekhttps://www.securityweek.com/irhythm-confirms-data-stolen-in-hack/Public source from securityweek.com.
iRhythm discloses data breach after hackers steal patient health information and demand ransomhttps://www.teiss.co.uk/irhythm-data-breach-patient-health-information-ransom/Public source from teiss.co.uk.
iRhythm discloses data breach, says hackers stole patient infohttps://www.bleepingcomputer.com/news/security/irhythm-discloses-data-breach-says-hackers-stole-patient-info/Public source from bleepingcomputer.com.
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attackhttps://www.helpnetsecurity.com/2026/06/21/week-in-review-74k-fortinet-firewall-credentials-stolen-splunk-enterprise-rce-under-active-attack/Public source from helpnetsecurity.com.
Related signals
Grouped by why the signal is relevant.
ACLA Data Breach Exposes Social Security Numbers and Medical Information
Anatomic and Clinical Laboratory Associates P.C. (ACLA) disclosed a data breach involving unauthorized access to its computer network. The breach, discovered in December 2025, exposed personally identifiable information (names, dates of birth, Social Security numbers, taxpayer identification numbers) and protected health information (medical dates of service, diagnoses, medical history) for 69 Massachusetts residents.
Horizon Family Medical Group Data Breach
Reports emerged on June 18, 2026, of a possible data breach at Horizon Family Medical Group, a medical provider in New York's Hudson Valley region. Threat actor Incransom claimed to have stolen 7 TB of data, including medical information such as diagnoses, prescriptions, treatments, and lab results.
One Medical Seniors Data Breach Exposes Patient Records
One Medical Seniors, the primary care division of Amazon-owned One Medical (formerly Iora Health), experienced a data breach that occurred between June 8 and June 11, 2026. An unauthorized party gained access to a third-party file storage system containing archived patient data. One Medical identified the unauthorized access on June 13, 2026. The ShinyHunters data extortion group claimed responsibility for the breach, alleging the exfiltration of 8.8 terabytes of data. The exposed information includes demographic and clinical records of former Iora Health/One Medical Seniors patients across multiple U.S. locations, including Atlanta, Cape Cod, Charlotte, Piedmont Triad, Denver, Houston, Phoenix, Tucson, and Seattle.
Aligned Orthopedic Partners discloses email environment data breach
Aligned Orthopedic Partners discovered unauthorized access to its email environment between November 16, 2025, and December 16, 2025. The breach exposed protected health information of 7,213 individuals, including names, dates of birth, Social Security numbers, and medical treatment information.
Tampa Bay Dental Implants & Prosthetics discloses ransomware attack and data exposure
Tampa Bay Dental discovered unauthorized access to its network on January 19, 2026, when ransomware was used to encrypt files on a legacy server containing a backup of electronic medical records. Patient data, including names, contact information, birth dates, treatment notes, clinical histories, and for some, Social Security numbers, was exposed.
The Oncology Institute Notified of Patient Data Breach
Kroll, acting as a third-party administrator, notified The Oncology Institute on May 20, 2026, that an unauthorized actor had accessed systems containing patient data. The incident appears to have affected multiple other healthcare providers as well.