Cardiac monitoring is deeply personal data, and iRhythm, a maker of wearable heart-rhythm devices, is telling more than 360,000 people that intruders took their personal information from third-party-hosted business applications. For patients whose care rests on continuous cardiac records, a leaked file can expose medication history and treatment details many would rather keep private.
June 8 is when the company spotted the intrusion; its review placed the intruders inside the affected systems across June 3 to June 8.
Names traveled, and so did addresses, email addresses, dates of birth and phone numbers. Device and account data went too: account numbers, serial numbers, insurance numbers and dates of service. State regulators received iRhythm’s breach notices last week, and they set the affected count above 360,000 people. Texas accounts for 298,647 of that total and South Carolina for 69,526. The real number is probably larger.
Contact arrived on June 9, according to a June filing with the US Securities and Exchange Commission, and with it came a threat to publish the data unless a ransom arrived. Warning that no one had yet seen the information “has been or will be used to commit identity theft,” iRhythm spoke to the public last week in terms that hint the company may have paid.
iRhythm reports no fallout to its products, its clinical or medical device systems, its customer links, manufacturing or distribution, patient safety, or its capacity to serve patients. The company also said the matter is not reasonably likely to materially move its finances or results.
Clinical records are a favored fuel for targeted phishing and insurance fraud. Those affected should watch for medical bills they never incurred and review insurance statements for services they did not receive, while taking up the offered credit monitoring or a freeze if identity theft surfaces.
