iRhythm Breach Hits 360,000+ Patients After Ransomware Crew Steals Medical Data

Cardiac monitoring firm iRhythm is in the middle of notifying over 360,000 people that their personal data was stolen by hackers in early June. The company makes wearable heart monitors paired with cloud analytics, so its databases are exactly the kind of target that makes ransomware gangs salivate.

The intrusion ran from June 3 to June 8, targeting third-party hosted business applications. iRhythm says it detected the breach on June 8, which means the attackers had five days to help themselves. What walked out the door includes names, addresses, email addresses, dates of birth, phone numbers, insurance numbers, account numbers, device serial numbers, and dates of service. Not quite a full medical record, but more than enough to cause serious problems for anyone on the receiving end.

The day after discovery, the hackers made contact. On June 9, they threatened to publish the stolen data unless iRhythm paid up. The company subsequently told regulators it has no evidence the stolen information "has been or will be used to commit identity theft." Read into that what you will. Companies that refuse to pay ransoms rarely get to make that claim with any confidence.

State-level breach filings tell us the current known headcount: 298,647 affected individuals in Texas and 69,526 in South Carolina. Given that iRhythm operates nationally, those numbers are almost certainly just a slice of the total.

iRhythm has been at pains to point out that clinical systems, medical devices, patient safety, and manufacturing operations were unaffected. Its SEC filing echoed the same line, adding that the breach isn't expected to materially hit its finances. Whether that remains true once class action lawyers start sharpening their pencils is another matter.

The company has not publicly disclosed whether it paid the ransom.