iRhythm Faces Ransom Demands After Third-Party App Breach Exposed 360k Records
Hackers stole personal and medical data from third-party apps, prompting mass notifications and raising concerns about potential extortion.
Key points
- Hackers exfiltrated data from third-party applications between June 3 and June 8.
- At least 360,000 individuals in Texas and South Carolina are confirmed affected.
- The company reported receiving ransom demands but denies evidence of identity theft.
Medical technology firm iRhythm is notifying more than 360,000 people that their personal information was stolen by hackers. The breach involves data stored in third-party-hosted business applications, not the company’s core medical devices, according to SecurityWeek. This distinction is vital for understanding the scope of the exposure and the specific systems that failed to protect sensitive patient records during the intrusion.
The risk
The intruders accessed the affected applications between June 3 and June 8, stealing a wide range of personally identifiable information. This includes names, physical addresses, email addresses, dates of birth, and phone numbers. The stolen data also contains specific iRhythm account details, such as account numbers, device serial numbers, insurance numbers, and dates of service. This combination of personal and medical identifiers creates a high-risk profile for identity fraud.
Who is exposed
Regulatory filings indicate that at least 360,000 individuals were impacted by the data theft. The confirmed victims include 298,647 people in Texas and 69,526 residents of South Carolina. iRhythm notes that the total number of affected patients is likely significantly higher than these state-specific figures suggest. The company describes itself as a digital healthcare provider that uses wearable cardiac monitors and cloud analytics to process clinical data.
Cost and compliance
On June 9, hackers contacted iRhythm demanding a ransom to prevent the online leak of the stolen information. In a filing with the Securities and Exchange Commission, the company stated it has no evidence that the data has been used for identity theft. iRhythm also reported that the incident did not impact its products, clinical systems, or patient safety operations. The firm added that the breach is not likely to materially affect its financial condition.
What happens next
Managers should monitor their credit reports and bank statements for unauthorized activity, given the exposure of financial identifiers. Organizations using similar third-party hosted applications should review their vendor security practices and data storage policies. iRhythm continues to investigate the incident while maintaining that its core operations and patient care capabilities remain unaffected by the cyberattack.
Background: Medical device vulnerabilities
Isolate affected medical devices from the network immediately to stop data exfiltration. Verify firmware integrity before restoring connectivity. Document every action for compliance. Notify patients if health data was exposed. Implement strict network segmentation to prevent future lateral movement.
Read the full guide: Medical Device Vulnerability Response: Steps to Contain and Recover
What to do and how to stay safe: iRhythm
- Enable fraud alerts or place credit freezes with major bureaus to prevent new accounts from being opened in your name.
- Scrutinize bank and credit card statements for small, unrecognized transactions that could indicate compromised insurance or account numbers.
- Update passwords for any online accounts associated with the exposed email addresses, ensuring you use unique credentials for each service.
- Monitor your credit report regularly for signs of identity theft, as the stolen data includes dates of birth and insurance numbers.
Step-by-step guide: Data Breach Myths: Why Common Security Beliefs Fail
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was iRhythm's medical device software hacked?
No, iRhythm stated the breach involved third-party business applications and did not impact its clinical or medical device systems.
How many people were affected in Texas?
Approximately 298,647 individuals in Texas were confirmed to be affected by the data breach, according to regulatory filings.
Did iRhythm pay the ransom?
The company has not confirmed paying a ransom, though it noted no evidence of identity theft, which some analysts interpret as a potential payment.
