US cardiac monitoring firm iRhythm hit by social engineering and extortion; data of over 8.18 million exposed

According to CyberInsider, data was downloaded without authorization from cardiac monitoring firm iRhythm's third-party-hosted business applications between June 3 and 8, 2026; its June 15 SEC filing says access came through social engineering and an attacker demanded payment on June 9 ^[1]. According to SecurityWeek, an HHS filing lists 8,179,772 people affected, with names, addresses, birth dates, emails, phone numbers and account, device serial, insurance numbers and service dates exposed ^[2]. iRhythm recommends affected people review insurance explanations of benefits for unfamiliar services and report discrepancies, review financial statements and credit reports, and consider fraud alerts or credit freezes ^[1].

Industries mainly affected: Healthcare

1. Review health insurance explanations of benefits for unfamiliar services and report discrepancies ^[1].
2. Review financial statements and credit reports; consider fraud alerts or credit freezes .