The iRhythm breach exposed names, addresses, birth dates, contact details, insurance numbers and Zio monitor account data for about 8.2 million people in June 2026. Social Security numbers were not listed. Watch insurance statements for medical identity theft, treat iRhythm-themed calls as likely scams, and remove your address from data broker sites.
What Happened in the iRhythm Data Breach?
iRhythm Technologies is the California company behind the Zio wearable ECG patch, a heart monitor doctors prescribe to detect irregular rhythms. Millions of patients have worn one, which is why this breach is so large.
- June 3–8, 2026: According to iRhythm's notice letter, an unauthorized party accessed and downloaded data from certain third-party-hosted business applications the company uses.
- Mid-June 2026: iRhythm disclosed the incident publicly, including in a filing with the SEC. The attackers tried to extort the company, threatening to leak the stolen data.
- October 2026: iRhythm began mailing notification letters and filed notices with state regulators, including California (October 6). The Oregon Department of Justice listing puts the total at 8,179,772 people, up from early estimates of around 360,000.
iRhythm says the attack did not affect its Zio devices, clinical systems, manufacturing or patient safety. Your monitor results were not altered — but the administrative data around your care was taken.
What Data Was Exposed?
The notice letter lists the following, which can vary by person:
- Full name, mailing address, email address and phone number
- Date of birth
- Health insurance (patient insurance) number
- iRhythm account number and Zio device serial number
- Dates of service
Social Security numbers and bank details were not listed. That lowers the risk of someone opening new credit in your name, but the combination above is ideal for two things: medical identity theft (billing care to your insurance) and highly convincing phishing, because a scammer can quote your real device serial number, insurer and service date.
No Free Credit Monitoring in the Letter
The sample notice filed with the California Attorney General does not include an offer of free credit monitoring or identity protection. If someone calls or emails offering "free iRhythm identity protection" and asks for your SSN or a card number to enroll, treat it as a scam and contact iRhythm through the number on its official website or your letter.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
What to Do Right Now
1. Confirm the letter is real
Breach letters are a favorite template for scammers. Compare the return address and phone number with iRhythm's official site and the state attorney general filings before calling anything printed on a letter or email. Our guide to handling a breach notification letter walks through the checks.
2. Watch for medical identity theft
Your insurance number plus date of birth is enough for someone to try billing services to your plan. Read every Explanation of Benefits from your insurer for the next year and flag any provider, procedure or date you do not recognize. Request your claims history from your insurer once now and again in six months. If you spot fraud, follow the steps in what to do if your medical identity is stolen.
3. Expect targeted phishing and fake billing calls
The most likely follow-on attack is a call, text or email that references your Zio monitor, your cardiologist or your insurer and asks you to "verify" an account, settle a balance or update payment details. iRhythm and your insurer will not ask for a password, full SSN or card number by phone. Hang up and call back using a number you look up yourself.
4. Consider a credit freeze anyway
SSNs were not listed, but your name, address and date of birth are now in criminal hands, and those can be matched to SSNs leaked in other breaches. A freeze at Equifax, Experian and TransUnion is free and takes about 15 minutes — see how to freeze your credit at all three bureaus.
5. Check whether your email is circulating
Stolen datasets from extortion attacks often end up on leak sites even when a ransom is negotiated. Run your email through a breach checker and our guide on checking if your information is on the dark web, and change any reused passwords.
6. Remove your address and phone from data brokers
Leaked records age quickly — unless scammers can look up where you live now. People-search sites publish your current address, phone numbers and relatives for anyone who searches your name, letting criminals enrich a breach record and target you or family members. Removing those listings cuts that link. You can opt out site by site, or use one of the best data removal services to do it continuously.
Shrink What Scammers Can Add to the Leak
PrivacyOn removes your personal information from 100+ data brokers and people-search sites, re-checks for relisting, and includes dark web monitoring so you hear if your details surface again. Family plans cover up to 5 people from $8.33/month — useful when a breach hits an older parent who wore a Zio monitor. Start with a free exposure scan.
Is There an iRhythm Class Action Lawsuit?
Proposed class action lawsuits have been filed over the breach. No class has been certified and the claims are allegations only. You do not need to join anything to protect yourself; if a settlement is reached, notices are usually mailed to affected people. Keep your breach letter.
Frequently Asked Questions
Was my Zio heart monitor data stolen in the iRhythm breach?
iRhythm says its devices, clinical systems and patient safety were not affected. The stolen data came from third-party-hosted business applications and includes account details, device serial numbers, insurance numbers and dates of service rather than your ECG readings.
How many people were affected by the iRhythm data breach?
About 8.2 million. iRhythm reported 8,179,772 affected individuals in state filings, including Oregon's, after early reports put the number near 360,000.
Were Social Security numbers exposed in the iRhythm breach?
Social Security numbers are not listed among the exposed data in iRhythm's notice letter. Names, addresses, dates of birth, emails, phone numbers, insurance numbers, account and device numbers and dates of service were.
Is iRhythm offering free credit monitoring?
The sample notice filed in California does not include a credit monitoring offer. You can freeze your credit for free yourself, and a service like PrivacyOn adds dark web monitoring and data broker removal from $8.33/month.
How do I protect myself after the iRhythm data breach?
Review insurance statements for unfamiliar claims, ignore unsolicited calls or emails referencing iRhythm or Zio, freeze your credit, change reused passwords, and remove your current address and phone number from people-search sites so scammers cannot connect the leak to where you live today. PrivacyOn's free scan shows which broker sites list you.