Patient Data in the Business Applications

iRhythm's October breach update puts two facts next to each other: the company reported no identified impact to its clinical or medical device systems, and patient information had been downloaded from business applications hosted by third parties.

Both can be true. A device can remain unaffected while information about the person using it leaves through another system.

According to the company's October 2, 2026 notice, unauthorized access and downloading occurred between June 3 and June 8, 2026. The affected information included patient names and contact details, dates of birth and service, insurance and patient account numbers, and device serial numbers. Notifications began October 2 for affected individuals whose contact information the company held. Source: iRhythm's notice.

Its June filing attributed the incident to social engineering and reported an extortion demand. It did not name the affected applications or describe the precise deception. The October update said the company had found no evidence of identity theft. Neither the June filing nor the October notice discloses whether a ransom was paid. Sources: June SEC filing and October 2 announcement.

For a smaller business, this suggests a concrete exercise: choose one customer record and follow the copies. Where does it go after the main system—into a support tool, a billing service, or an export used by another team? Those are examples to investigate, not claims about iRhythm's setup.

A business application can hold sensitive information without operating the product the customer bought. Include those copies when deciding what data an incident could expose. Start the review with the fields that travel: the customer's name, account number, service history, and any other details sent along with the record.