Cardiac patients’ medical data stolen and held to ransom

### Executive summary iRhythm, a cardiac monitoring provider, disclosed a data theft and extortion incident in which an attacker claims to have obtained proprietary information and patient PHI via social engineering of third‑party hosted business applications; the company deems the incident significant given the potential volume, is investigating, will notify affected individuals as required, and the report warns patients about phishing, identity and medical fraud risks while offering mitigation advice.