iRhythm breach: social engineering hit third-party SaaS apps; 360,000+ patients notified
Cardiac-monitor maker iRhythm says attackers used social engineering to steal patient data from third-party SaaS apps in June 2026, then demanded a ransom.
iRhythm, which makes the Zio heart-rhythm monitors, told the SEC in June 2026 that attackers stole patient data from third-party-hosted business applications after a social-engineering attack, then demanded payment to keep it private. Notifications filed with state regulators in October show at least 360,000 people affected. For engineering teams the takeaway is uncomfortable: the attackers didn't need to breach the medical-device platform. They went for the SaaS tools around it.
What happened
According to iRhythm's Form 8-K (Item 1.05), the company identified unauthorized activity involving data held in "certain third-party-hosted business applications" on 8 June 2026. Later notices put the access window at 3–8 June. On 9 June, an unnamed actor contacted the company claiming to hold proprietary data, patient protected health information (PHI) and other personal information, and demanded payment in exchange for not publishing it. iRhythm confirmed that data had been taken and on 10 June determined the incident was material because of the volume of data involved. The filing, signed 15 June, attributes the access to social engineering. It says clinical and medical-device systems, manufacturing, financial reporting and patient safety were not affected, and that the company doesn't store payment card or financial account data.
In October 2026, SecurityWeek reported breach notices filed in Texas (298,647 people) and South Carolina (69,526 people), at least 360,000 in total. The notices list names, addresses, email addresses, dates of birth, phone numbers, iRhythm account numbers, device serial numbers, insurance numbers and dates of service. iRhythm hasn't named the third-party application or the attacker, and no known extortion group has publicly claimed the attack.
Who is affected
- iRhythm patients, mainly people prescribed Zio monitors in the U.S. The full national count hasn't been published, so the 360,000 figure from two states is a minimum.
- Healthcare and health-tech companies that keep PHI in CRM, ticketing, support or file-sharing SaaS, all of which are now proven targets.
- Help-desk and IT support staff, who are usually the people social-engineering attacks are aimed at.
What it means for developers and engineering teams
The vendor isn't named, but the pattern matches a series of 2025–2026 extortion campaigns in which attackers phone or message a help desk, impersonate an employee, get an MFA reset or persuade someone to authorise a malicious connected app, then bulk-export records from a SaaS tenant through its API. Nothing in the core product is exploited. The weak points are identity-recovery processes and over-permissioned integrations.
Three engineering lessons follow. First, data minimisation: copies of PHI tend to spread into support tickets, CRM fields and analytics exports where nobody owns them. Second, OAuth app governance: a connected app with broad read scope and a long-lived refresh token is effectively a database export credential. Third, detecting bulk reads: most SaaS platforms log API exports, but few teams alert on them.
This incident also follows the SEC's cybersecurity disclosure rule. iRhythm determined materiality on 10 June and filed within the required four business days. Engineering leaders should expect to be asked for scope estimates within hours, so the logging and data-mapping work above is also what makes a fast, accurate disclosure possible.
What to do now
- Inventory every SaaS application that holds customer or patient data, along with its admins, connected apps and API tokens.
- Require phishing-resistant MFA for SaaS admins and lock down help-desk MFA reset flows. Require call-back or manager verification before resetting factors.
- Review OAuth connected apps. Remove unused ones, restrict which users can authorise new apps, and cap token lifetimes.
- Stream SaaS audit logs to your SIEM and alert on large exports, report downloads or unusual API query volume from a single identity.
- Remove PHI from free-text support and CRM fields where it isn't needed. Tokenise or reference records instead.
- Include a third-party SaaS breach scenario in your incident-response and SEC/HIPAA disclosure runbooks.
Related on TechLogHub
- OAuth 2.0: how connected-app tokens work
- Authorization: scoping access to sensitive data
- Clerk vs Auth0: identity platforms and MFA options