iRhythm's breach notice told patients what was stolen but never said how many of them there were. The attorneys general said it instead: 298,647 Texans, 69,526 South Carolinians, per filings published last week. That is the story. A medical-device company knew the volume in June and let the victims find it in a regulator's filing cabinet in October. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source.
We covered iRhythm's original disclosure when the notices went out: intruders got into third-party-hosted business applications between June 3 and June 8, after a social engineering attack, and walked out with patient data including email addresses. The notice described what was taken, when it was taken, and that the company's medical devices were untouched. It just never said how many people were affected.
The filings name the number; the notice never did
SecurityWeek did the reading on October 12. Texas filed 298,647, posted to its attorney general's breach portal on October 6. South Carolina filed 69,526. The two states add up to 368,173, and every outlet rounds the running count to "at least 360,000." The HIPAA Journal read the same filings and counts it the same way: more than 360,000 individuals in Texas and South Carolina alone. SecurityWeek's verdict on the full picture: the total "is likely significantly higher."
Two details keep the number from being final. First, Texas and South Carolina only report their own residents. California filings also exist, per ISSSource's reporting on the disclosure, and no California count has been published anywhere. Every other state's count is still sitting in some filing, waiting to be read. Second, the company has still not published a total of its own. The only nationwide number belongs to the paperwork.
One thing the paperwork does not answer is whether iRhythm paid. The attackers demanded money on June 9. The company has not said either way, and no outlet has confirmed it. SecurityWeek does flag the company's "no evidence" phrasing, that the stolen information "has been or will be used to commit identity theft," and reads it as a hint the ransom may have been paid to keep the data offline. That is SecurityWeek's inference, not a fact, and it matters that it stays labeled that way. If iRhythm did pay, victims should know one thing about that: buying stolen data back does not delete the copies. People get the notice either way.
How the four-month silence reads now
June 3-8, 2026: attackers reach the third-party-hosted business applications and download patient data. The way in is social engineering. On June 9 the threat actor contacts the company and threatens to leak the stolen information unless a ransom is paid, per the June SEC filing. On June 10 the company determines the incident is material "in light of the volume of the potentially affected data," per the SEC notice quoted by ISSSource. On June 15 the incident is described as material in a federal securities filing.
So the regulators knew about the volume in June. The consumer notice, mailed October 2, never mentioned it. Then, on October 6, the Texas attorney general's breach report was published with the number: 298,647.
Look at the June 10 sentence again: "in light of the volume of the potentially affected data." Volume was in the sentence in June. It never made it into the letter in October. This is the mechanism worth understanding. State breach-notification laws require companies to report exact victim counts to the attorneys general, and those filings become public. The consumer letter has no such precision requirement, so it speaks in generalities: what was taken, when, what the company is doing. The number lives in the filing. Victims were told to worry without being told the scale.
What iRhythm patients should do first
That address has been yours for years, and the file that leaked reads like an intake form. Start here:
- Read your insurance Explanations of Benefits. The leak includes insurance numbers plus dates of service, which is the exact kit for medical identity fraud: someone else's treatment billed to your policy. An unrecognized claim on an EOB is the earliest signal.
- Treat every "device update" call as hostile until proven otherwise. iRhythm makes wearable cardiac monitors, which means a caller quoting your device serial number or insurance details sounds credible asking you to "confirm" the rest. Verify through iRhythm's own site, typed by you into the browser. No link, no callback number from the caller.
- Set up the fraud alert or security freeze iRhythm itself recommends, and pull your free credit reports. This leaked file had no payment card numbers in it, per the company, but identity records this complete get used at the margins of everything.
- Harden your health and insurance portals. Unique password on each, second factor on. Your leaked email address will be paired with passwords from other breaches; the second factor is the part no leaked file defeats.
- Do not click any link in any email about this breach, including the real notification. Open the app or type the URL yourself. The breach notice is now the template the forgeries will copy, so a habit that only works against the real ones is not a habit.
- Check Have I Been Pwned once this incident is listed, and run through the breach-response order of operations.
Names, addresses, phones, emails, dates of birth, insurance numbers, account numbers, device serial numbers. That is not a spam list; it is a credential the caller can read back to you to sound like iRhythm, your insurer, or your clinic. Anyone who "confirms your identity" by reading your own details back to you is proving they have the file, not that they are who they say they are.
The address you could have made expendable
Look at the exposed record one more time: your name, your date of birth, your address, your phone number, your insurance number, your device serial. Almost nothing on that list is something you can take back or rotate. The email address you handed the patient portal was different. It was a choice.
An email alias dedicated to iRhythm, forwarding to your real inbox, changes the aftermath in two ways. First, every message on that alias is either from iRhythm or from the attacker, and there is no third option: a "breach update" asking for your insurance details, on an address no one but iRhythm ever had, has identified itself as the forgery. Second, the leak-tracing mechanism works exactly this way: the alias names its source, so the next leak does not take ten days of state filings to explain. Kill the alias and the scam loses its channel while your real inbox never sees it. The set-up guide takes about two minutes.
An alias would not have kept your insurance number or your date of birth out of that file. The breach still happens; the data the attackers already held is still gone. What the alias changes is which inbox the aftermath arrives in, and whether you can prove where it escaped from. That is all it claims, and it is enough.
The questions still open
Three things. First, whether iRhythm ever names a national total itself. The California notices are filed; no California count has been published. The floor is 368,173 across two states. Until the company says otherwise, treat 360,000 as the floor, not the ceiling.
Second, the ransom question. A straight answer, either way, is owed to 360,000 people.
Third, whether the dataset surfaces publicly. A threat actor who threatened to leak and was not paid usually follows through; one who was paid usually does not. The ransom answer decides which timeline we are on.
The number was in the paperwork all along. The question was whether anyone would read it. This time, someone did.
Top comments (0)