Hundreds of thousands impacted by data breach at biosensor firm iRhythm
iRhythm says data of at least 360,000 patients was stolen in a June breach of third-party systems via social engineering, with a threat actor demanding payment.
Medical device maker iRhythm disclosed that hackers accessed third-party-hosted business applications between June 3 and June 8 through a social engineering attack, stealing data on at least 360,000 people, including 298,647 in Texas and 69,526 in South Carolina. Stolen data includes names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service, and dates of birth. A threat actor demanded payment to avoid publicly disclosing the exfiltrated data, per an SEC 8-K filing. The company says clinical systems, Zio Patch devices, and operations were not affected.
- At least 360,000 people affected; 298,647 in Texas and 69,526 in South Carolina
- Hackers accessed third-party systems June 3–8 via social engineering
- Threat actor demanded payment after exfiltrating patient and proprietary data
- No impact on clinical systems, Zio Patch devices, or operations
Full article478 words · extracted from therecord.media · click to collapse
Medical device maker iRhythm said the data of at least 360,000 people was breached in a June cyberattack. The company began filing breach notices in multiple states this week, telling regulators and victims that the incident occurred on June 8 and involved unauthorized access to third-party systems. iRhythm is best known for Zio Patch — a sensor that patients wear on their chest for long-term continuous cardiac monitoring and heart arrhythmia detection. The company said 298,647 people in Texas had information stolen alongside another 69,526 in South Carolina. iRhythm also filed breach notices in California. A company spokesperson declined to say the full number of victims, telling Recorded Future News that iRhythm “responded promptly after detecting the unauthorized access and, once the scope was verified, notified affected individuals and applicable regulators.” “The incident did not affect iRhythm clinical systems or medical devices and did not result in a loss of service or disruption to operations,” the spokesperson said. An investigation into the incident revealed that hackers had access to company systems between June 3 and June 8. The hackers gained access to unidentified third-party-hosted business applications through a social engineering attack. The information stolen includes names, addresses, phone numbers, iRhythm patient account numbers, iRhythm device serial numbers, patient insurance numbers, dates of service, and date of birth. The cybercriminals accessed and downloaded the information, according to a statement from iRhythm. The company said it has “no evidence that any personal information has been or will be used to commit identity theft.” No hacking group ever publicly took credit for the attack. The cyberattack did not impact the company’s products, devices, manufacturing process or distribution operations — and iRhythm said its finances were not disturbed. The company reported $224.2 million in Q2 revenue. In a June 8-K filing with the Securities and Exchange Commission (SEC), iRhythm said it “received communications from a threat actor claiming to have obtained sensitive information, including proprietary data, patient protected health information and other personal information.” “The communications from the threat actor demanded payment in exchange for not publicly disclosing this information,” the company said. “Since receipt of the communications, the Company has confirmed that certain data was exfiltrated from those applications.” Medical device companies have been battered by cybercriminals over the last two years, with dozens experiencing cybersecurity incidents that impacted crucial business and manufacturing systems. Cyberattacks on Medtronic, Boston Scientific, Stryker, UFP, Masimo, Surmodics, Artivion and Zoll have leaked the sensitive medical data of millions and caused supply chain issues.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.