What should I do immediately after a data breach?

Change your password for the affected account and any other account where you reused that password. Enable two-factor authentication. Monitor your bank and credit card statements. Place a free credit freeze at Equifax, Experian, and TransUnion. If your Social Security number was exposed, file an identity theft report at IdentityTheft.gov.

How long do companies have to notify me after a data breach?

In the US, notification timelines vary by state — typically 30 to 90 days after a breach is confirmed. Under GDPR in Europe, companies must notify regulators within 72 hours. Many states require individual notification "in the most expedient time possible." Companies often delay notification while investigating.

Should I freeze my credit after a data breach?

Yes. A credit freeze prevents new accounts being opened in your name without your explicit unfreeze. It is completely free at all three major bureaus, does not affect your credit score, and does not impact existing accounts. Unfreeze temporarily when you need to apply for credit, then refreeze immediately.

Your Heart Monitor Company Was Hacked: 8 Million Patients' Data Stolen for 4 Months

The Device Trusted With Your Heart Was a Gateway to Your Identity

If you wore an iRhythm Zio patch in the last few years, someone may already have your insurance number, your date of birth, and the exact dates you sought cardiac care. Not because a hacker broke through software defenses. Because they picked up the phone and lied to an employee.

That single fact should change how you think about medical privacy.

What Is the Zio Patch, and Why Does the Breach Matter?

The Zio patch is a small, adhesive cardiac monitor made by iRhythm Holdings. Patients wear it for days or weeks at a time while it continuously records heart activity. Cardiologists and general practitioners prescribe it to catch arrhythmias, atrial fibrillation, and other conditions that don't show up in a standard ten-second EKG.

Millions of patients trust it with some of the most sensitive data that exists: a live window into their heart, tied to their full name, their insurer, their medical history.

That trust now has a crack in it.

How Did Hackers Get In?

The attackers did not find a software vulnerability. They did not crack a password or exploit a server flaw. They used social engineering, which means they manipulated real people into giving them access.

Between June 3 and June 8, 2026, attackers targeted third-party cloud applications that iRhythm uses to run its business. The exact manipulation isn't fully public, but social engineering typically involves impersonating IT staff, a vendor, or a trusted authority to convince an employee to hand over credentials or approve access. Once inside, the attackers took what they came for. Then they demanded payment in exchange for not releasing it.

This is a ransomware-adjacent playbook called extortion. The stolen data becomes leverage. Pay us, or your patients find out.

iRhythm says the clinical systems and the monitors themselves were never touched. The breach was entirely in supporting cloud infrastructure. That distinction matters for patient safety. It matters less for everyone whose personal information was already gone.

The Numbers

On June 10, 2026, iRhythm disclosed the breach to the U.S. Securities and Exchange Commission as a "material" event. That is a legal term with weight. It means the company's own leadership believed this incident was significant enough to affect investors.

Patient notifications did not begin until October 2, 2026. Nearly four months passed between the SEC filing and the first letters reaching the people most directly harmed.

An Oregon attorney general filing made public around October 16 confirmed the full scope: 8.2 million individuals had data exposed.

What was taken: full names, contact information, dates of birth, patient account numbers, device serial numbers, insurance numbers, and dates of service. That combination is a toolkit for targeted phishing and insurance fraud. An attacker who knows your name, your insurer, your policy number, and the fact that you recently sought cardiac monitoring can craft a convincing fake bill, a fraudulent insurance appeal, or a personalized scam that references details no stranger should know.

No confirmed misuse has been reported as of the notification date. That is not reassurance. It is a clock.

What Should You Do Right Now?

You do not need to wait for iRhythm to tell you your data was taken. Act on the assumption that it was, because 8.2 million people is not a small slice.

Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion each let you do this for free online. A credit freeze blocks new accounts from being opened in your name. It costs nothing to place and nothing to lift. Do this before anything else.
Check your Explanation of Benefits statements. Log into your health insurance portal and look at recent claims. If you see a service you did not receive, call your insurer's fraud line immediately. Insurance fraud using stolen medical data can take months to surface.
Watch for hyper-personal phishing. An email or text that references your cardiac monitoring, your insurer's name, or your device is not proof that it is legitimate. Attackers with this data will use those details to earn your trust. Treat any unexpected medical billing communication with suspicion. Call the provider directly using the number on their official website, not the one in the message.
Enable two-factor authentication on your health insurance portal, your email, and your patient apps. Use an authenticator app rather than SMS when the option exists. Passkeys are better still if your account supports them.
If iRhythm contacts you with an official breach notice, follow the instructions for any free credit monitoring they offer. Take it even if you have already frozen your credit. Document everything.
Consider signing up for a data-removal service or manually requesting removal from data brokers. Your name, DOB, and address are now in the wild. Data brokers aggregate and resell exactly this kind of information, making you easier to find and target.

The Four-Month Gap Is the Real Story

iRhythm had a legal and ethical obligation to notify patients as quickly as reasonably possible. Most U.S. states require notification within 30 to 60 days of a breach's discovery or confirmation. Four months is not a delay. It is a pattern that keeps repeating across healthcare breaches, where companies balance legal exposure against operational complexity while patients remain unaware.

You cannot opt out of this risk when your doctor prescribes the device. You are not choosing to share your data with iRhythm's cloud vendors. You are choosing to monitor your heart.

That asymmetry is the real vulnerability in the system. The device works perfectly. The infrastructure around it failed you before you ever found out.

Do this now:

Freeze your credit (free, takes five minutes per bureau)
Check your insurance claims for anything unfamiliar
Turn on 2FA for your health and email accounts
Treat any medical billing message as suspicious until verified by direct call