The HIPAA Journal reports that the scale of iRhythm Technologies' June 2026 data breach has finally been confirmed.

The Oregon Attorney General has added the incident to the state's data breach list as involving the personal and protected health information of 8,179,772 individuals. iRhythm, maker of the Zio wearable ECG monitor, serves roughly 8 million patients, so the figure suggests the hackers obtained data related to essentially the company's entire customer base.

Days earlier, the known count stood only around 368,000 people across Texas and South Carolina.

According to The HIPAA Journal's account of the SEC filing, iRhythm first identified unauthorized access to certain business applications hosted on a third-party platform on June 8, 2026.

One day later, a threat actor contacted the company claiming to have exfiltrated sensitive data and demanded payment to prevent its public release.

The company says the attacker got in through social engineering, activated its incident response plan, and disclosed the event as material in a Form 8-K. The filing does not say whether any payment was made or negotiated.

Notification letters sent starting October 9, 2026, confirmed the stolen data includes patient names, addresses, phone numbers, email addresses, account numbers, device serial numbers, insurance numbers, dates of birth and dates of service, per The HIPAA Journal. iRhythm says no financial account or payment card information is retained, its medical devices, clinical systems and patient connections were untouched, and it is unaware of any misuse of the data so far.

The company does not expect a material financial impact, though it warned of reputational harm and holds cyber insurance.

A breach touching a vendor's whole patient base is rare even by healthcare standards, and it lands amid a punishing stretch for the medical device sector.

The HIPAA Journal notes recent incidents at UFP Technologies in February 2026, Stryker with roughly 50 terabytes of data exfiltrated in March, and Medtronic's March theft of around 9 million patient records.

The pattern shows how patient data concentrated with device and analytics vendors makes a single compromise a mass-casualty privacy event.

The iRhythm confirmation arrives as state attorneys general sharpen their stance on vendor responsibility.

Holland & Knight reports that effective October 1, 2026, Labcorp agreed to pay $2,287,455 and overhaul vendor oversight across 44 attorneys general's settlement over a debt collector's 2019 breach, including a mandatory vendor risk management program, NIST-framework contract requirements and annual penetration testing and SOC 2 audits from debt collectors.

Regulators' message — that companies cannot outsource their duty to protect sensitive data — applies directly to device makers like iRhythm.

The incident is not yet listed on the HHS Office for Civil Rights breach portal, so a federal tally is still pending, though regulators have been notified and state attorneys general continue publishing resident counts. iRhythm says it has taken steps to mitigate harm to affected individuals and regularly evaluates its security controls, per The HIPAA Journal.

With notification letters out and the 8.18 million figure now on Oregon's breach list, watch for the OCR portal entry and any subsequent litigation or regulatory follow-up to fix the final toll.