BREACH WATCH BRIEF High 📱 Breach

iRhythm Biosensor Firm Breach Exposes Data of 360,000 Patients via Third‑Party Application Compromise

A June cyberattack on iRhythm’s third‑party business applications led to unauthorized access and exfiltration of personal and health data for at least 360,000 individuals. The incident highlights the need for continuous third‑party oversight and defensible audit evidence for compliance readiness.

ADTP Breach Watch · October 9, 2026 · The Record

SeverityHigh

Type📱 Breach

ConfidenceHigh

ReportedOct 9, 2026

Healthcare & Life Sciences Healthcare providers using iRhythm’s cardiac monitoring devices Patients with Zio Patch sensor data Medical‑device manufacturers reliant on third‑party SaaS tools Phishing Data Exfiltration

Check if you use it. This incident came through a third party or the supply chain. If the product or supplier is in your estate or your vendors', start with the questions to ask below.

What happened

Between June 3 and June 8, threat actors leveraged a phishing‑based social‑engineering attack to gain credentials to iRhythm’s third‑party‑hosted business applications. They accessed and downloaded patient names, contact details, insurance numbers, device serial numbers, and service dates, affecting roughly 360 k people. iRhythm’s clinical devices and operations remained unaffected.

Why it matters for trust and compliance

The breach underscores how a robust third‑party risk program—continuous monitoring of vendor access, documented due‑diligence, and an auditable incident‑response trail—provides the control assurance regulators expect from health‑technology firms.
Demonstrates the need for continuous evidence of third‑party access controls to satisfy audit requirements.
Highlights the importance of documented vendor risk assessments and incident‑response evidence for regulatory filings.

Who is affected

Healthcare providers using iRhythm’s cardiac monitoring devices Patients with Zio Patch sensor data Medical‑device manufacturers reliant on third‑party SaaS tools

Recommended actions

Initiate a third‑party risk reassessment focusing on access controls and MFA for all external applications.
Gather and preserve logs, access records, and vendor contracts as audit evidence.
Refresh phishing‑awareness training for staff and enforce MFA on all third‑party accounts.
Update incident‑response playbooks to include supply‑chain compromise scenarios.

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.