The maker of wearable cardiac monitors has begun writing to patients about a June intrusion into its business applications, and the numbers now attached to it are far larger than the company’s public confirmation.
iRhythm detected unauthorized activity on June 8 and traced the attacker’s access and downloads to the June 3 to June 8 window. State filings made public in October list 298,647 Texas residents and 69,526 in South Carolina, or 368,173 confirmed by name. An aggregation of those filings puts the nationwide figure at 8,179,772, a total the company has not disclosed itself.
What went out: names, home addresses, email addresses, phone numbers and dates of birth, plus account numbers, cardiac monitoring device serial numbers, health insurance numbers and dates of service. No payment card or financial account data was involved.
Per its October 2 notice, the entry point was social engineering aimed at externally hosted business applications. In a June filing with the U.S. Securities and Exchange Commission, iRhythm said the attackers made contact on June 9 claiming to hold proprietary information, protected health information and personal records, and demanded payment to stay quiet. The company has not said whether it paid.
It also said the incident did not touch its medical devices, clinical systems, customer connections, manufacturing or distribution, and the monitoring service kept running, which fits a compromise confined to third-party cloud software rather than hardware in a clinic.
The gap between roughly 368,000 named patients and an 8.2 million aggregate is the figure device makers and their hospital customers should watch. Vendor-hosted applications can hold far more patient identities than any single device fleet, and state filing trackers surface the scale long before a company letter does.
Patients are being told to review insurance statements and watch financial accounts.
