iRhythm data breach hits 360,000+ patients after extortion
Medical equipment provider iRhythm is notifying more than 360,000 people that attackers stole their personal information, SecurityWeek reports. The company identified the iRhythm data breach on June 8, and says hackers had taken patient data from third-party-hosted business applications. Regulator filings put the confirmed count at 360,000 people, and the real total is likely higher.
What we know
- iRhythm identified the incident on June 8. It involved third-party-hosted business applications that stored certain company information.
- Its investigation determined that hackers accessed and exfiltrated patient data between June 3 and June 8.
- In a June filing with the US Securities and Exchange Commission, the company said the attackers contacted it on June 9 and threatened to leak the stolen data online unless a ransom was paid.
- Breach notices filed with state regulators last week list 298,647 affected people in Texas and 69,526 in South Carolina.
Who is affected
The notified individuals are iRhythm patients. According to the report, the stolen data includes:
- Names, addresses, email addresses, dates of birth and phone numbers.
- iRhythm account and device data, such as account numbers, serial numbers, insurance numbers and dates of service.
The 360,000 figure only adds up the Texas and South Carolina notices. Counts from other states, and the overall total, have not been disclosed.
What has not been confirmed
- Total number of victims: not disclosed; SecurityWeek says it is likely significantly higher.
- Whether a ransom was paid: not stated. iRhythm said it has no evidence the data “has been or will be used” for identity theft, which SecurityWeek says suggests it gave in to the extortionists. That is the outlet’s inference, not a company statement.
- Attacker identity and entry method: not disclosed.
- Which third-party applications were involved: not disclosed.
iRhythm says it has not identified any impact to its products, clinical or medical device systems, customer connections, manufacturing and distribution, or patient safety. It also says the incident is not reasonably likely to materially affect its finances. SecurityWeek has asked the company for more information.
Why this matters
Analysis, not reported fact. The mix of identity details, insurance numbers and service dates is useful for targeted phishing and insurance or medical fraud. Because the data was taken during a short window and used for extortion, affected people should assume it may circulate even if the company has seen no misuse. The incident also shows the risk of data held in third-party-hosted business applications, which are often outside the monitoring applied to core systems.
What to do
If you received a notice from iRhythm:
- Read the notice and use any monitoring or support it offers.
- Treat unexpected calls, emails or texts that mention iRhythm, your device or your insurer as suspect. Contact the organisation through a number you already trust.
- Review insurance statements for services you did not receive, and report them to your insurer.
- Consider a credit freeze or fraud alert, and watch for the same email address or phone number appearing in phishing.
For security teams:
- Inventory third-party-hosted business applications that hold customer or patient data, and confirm who owns access logging for each.
- Alert on bulk exports and unusual access from those applications, and review how long logs are kept.
- Rehearse an extortion scenario, including the decision process for contact from attackers and regulator and SEC notification timelines.
