iRhythm discloses cyber incident with data exfiltration; threat actor demanded payment

iRhythm Holdings, Inc. disclosed a cybersecurity incident: Unauthorized activity involving data maintained on certain third-party-hosted business applications, obtained through social engineering, resulting in exfiltration of proprietary data, patient protected health information and other personal information. Impact: The Company has not identified any impact to its products, clinical or medical device systems, patient safety, manufacturing and distribution operations, financial reporting systems, or the ability to meet patient needs. The Company believes the incident is not reasonably likely to have a material i. Company determined it material. Discovered 2026-06-08.

Nature

Unauthorized activity involving data maintained on certain third-party-hosted business applications, obtained through social engineering, resulting in exfiltration of proprietary data, patient protected health information and other personal information.

Impact

The Company has not identified any impact to its products, clinical or medical device systems, patient safety, manufacturing and distribution operations, financial reporting systems, or the ability to meet patient needs. The Company believes the incident is not reasonably likely to have a material i

Materiality

determined material

Discovery

2026-06-08