iRhythm Extortion Incident Exposes 360k+ Patient Records via Third-Party Apps June 3-8

The breach was confined to cloud-hosted business applications rather than clinical monitoring platforms or device firmware. State filings in Texas and South Carolina alone account for 368,173 individuals; the company has not published a consolidated total or identified the specific SaaS vendors involved. iRhythm’s SEC 8-K states the incident is not material to operations or finances, yet the absence of observed identity-theft activity after exfiltration is consistent with ransom payment.

Healthcare device firms have repeatedly shown elevated third-party exposure: Oracle Health’s 2023 incident and the 2024 Change Healthcare compromise both originated in vendor environments. iRhythm’s June 9 extortion contact and subsequent “no evidence of misuse” statement track the same pattern seen in those cases, where payment precedes public minimization. Procurement records and job postings indicate iRhythm relies on multiple unsegmented business applications for patient onboarding and claims processing.

Regulatory follow-up is expected from HHS OCR and state attorneys general once full notification volume is known. Class-action exposure and potential OCR corrective-action demands will hinge on whether iRhythm can demonstrate reasonable vendor due diligence prior to the incident. No technical indicators have been shared that would allow independent verification of containment.