iRhythm Data Breach Impacts at Least 360,000 People
iRhythm says hackers stole personal and device data on at least 360,000 people and demanded a ransom.
Medical-device company iRhythm is notifying at least 360,000 people that attackers accessed third-party-hosted business applications and stole data between June 3 and June 8. The data includes names, addresses, emails, dates of birth, phone numbers, account and device serial numbers, insurance numbers, and dates of service. State filings list 298,647 people in Texas and 69,526 in South Carolina. iRhythm told the SEC the attackers demanded a ransom on June 9 and says it has no evidence of identity theft or impact on clinical systems or operations.
- Notices cover at least 360,000 people, with the true total likely higher.
- Attackers stole data from third-party apps between June 3 and June 8.
- Exposed fields include contacts, insurance numbers, and device serials.
- On June 9 attackers threatened to leak the data unless paid.
- iRhythm reports no identity-theft evidence or impact on clinical systems.
Full article355 words · extracted from securityweek.com · click to collapse
Medical equipment provider iRhythm is notifying more than 360,000 people that hackers stole their personal information.
The data breach was identified on June 8 and involved third-party-hosted business applications that stored certain iRhythm information, the company says.
During its investigation into the incident, iRhythm determined that hackers accessed and exfiltrated patient data from the affected applications between June 3 and June 8.
The compromised information includes patients’ names, addresses, email addresses, dates of birth, and phone numbers, as well as iRhythm account and device data, such as account numbers, serial numbers, insurance numbers, and dates of service.
Based on data breach notices iRhythm filed last week with regulators in several states, at least 360,000 individuals (298,647 in Texas and 69,526 in South Carolina) were affected. The total number of impacted patients is likely significantly higher.
In a June filing with the Securities and Exchange Commission (SEC), the company said the hackers contacted it on June 9, threatening to leak the stolen information online unless a ransom was paid.
Advertisement. Scroll to continue reading.
Last week, iRhythm said it currently has no evidence that the stolen information “has been or will be used to commit identity theft,” which suggests that it gave in to the extortionists.
“As iRhythm previously reported, the company has not identified any impact to our products, our clinical or medical device systems, our connections to customers, our manufacturing and distribution operations, patient safety, or our ability to meet patient needs,” the company said.
Additionally, iRhythm noted that the incident is not reasonably likely to materially impact its financial condition or results of operations.
SecurityWeek has emailed iRhythm for additional information on the data breach and will update this article if the company responds.
iRhythm describes itself as a digital healthcare company that combines wearable cardiac monitoring biosensors with cloud-based data analytics to turn cardiac data into clinically actionable information.
Related: Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million
Related: Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
Related: Advantest Discloses Data Breach Months After Ransomware Attack