iRhythm Biosensor Firm Breach Exposes Data of 360,000 Patients via Third‑Party Application Compromise
What Happened — A cyberattack on iRhythm’s third‑party‑hosted business applications resulted in unauthorized access from June 3‑8. Hackers used a social‑engineering (phishing) technique to infiltrate the systems and exfiltrated personal and protected health information for at least 360 k individuals. The breach did not affect the company’s clinical devices or operations.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party access points is essential to detect and stop unauthorized activity before data is exfiltrated.
- Maintaining auditable evidence of vendor oversight (e.g., access logs, risk assessments) supports a defensible audit trail across frameworks.
- Incident‑response documentation that ties the breach to a specific control gap demonstrates due‑diligence to regulators and partners.
Who Is Affected – Healthcare providers and patients using iRhythm’s Zio Patch cardiac monitoring solution; broader medical‑device and health‑technology ecosystem.
Recommended Actions –
- Conduct an immediate third‑party risk review focusing on access controls and authentication for all external applications.
- Collect and preserve logs, access records, and vendor contracts as evidence for audit readiness.
- Update phishing‑resilience training and enforce multi‑factor authentication for any third‑party accounts.
- Validate that incident‑response playbooks address supply‑chain compromise scenarios.
Source: The Record
Technical Notes – Attack vector: social‑engineering/phishing to compromise a third‑party‑hosted business app. Data stolen: names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service, DOB. No evidence of subsequent identity‑theft use.