iRhythm Discloses Data Breach After Threat Actor Claims PHI Theft

iRhythm disclosed a cybersecurity incident involving unauthorized access to certain third-party-hosted business applications, reporting that sensitive information — including patient protected health information and proprietary company data — may have been exfiltrated and that a threat actor contacted the company demanding payment; iRhythm says core clinical and device systems remain unaffected, an investigation with external specialists is ongoing, and the company considers the incident material due to the volume of potentially affected information.