Loading story…
iRhythm Holdings disclosed a material cybersecurity incident after attackers used social engineering to access certain third-party-hosted business applications and exfiltrate sensitive data. According to the company’s SEC filing, unauthorized activity was identified on June 8, and on June 9 a threat actor contacted iRhythm claiming to possess proprietary company information, patient protected health information, and other personal data, while demanding payment to stop the information from being publicly released.
The company said the intrusion was confined to third-party business applications and that there is no evidence its products, clinical or medical device systems, customer connections, patient safety, manufacturing and distribution operations, or financial reporting systems were affected. iRhythm has not named a responsible group or disclosed how many individuals were impacted, and said it is still investigating with external cybersecurity experts whether the attacker’s claims fully match the data stolen; it also stated that payment card and financial account information were not involved and that it has not found evidence of ongoing unauthorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On June 10, 2026, iRhythm determined the incident was material and disclosed it in a Form 8-K. The filing said stolen data came from third-party-hosted business applications, that products and clinical systems were not impacted, and that no ongoing unauthorized access had been identified as of the filing date.
On June 9, 2026, a threat actor contacted iRhythm claiming to possess sensitive information, including proprietary data and patient protected health information, and demanded payment to prevent public disclosure. The company later confirmed that certain data had been exfiltrated.
On June 8, 2026, iRhythm identified unauthorized activity involving data stored in certain third-party-hosted business applications. The company said the intrusion involved social engineering.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcesecurityweek.com
Open sourcesec.gov
Open sourcesec.gov
Open sourceirhythmtech.com
Open sourced18rn0p25nwr6d.cloudfront.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 3, 2026
**Intuitive Surgical** disclosed that attackers gained access to internal business administrative systems after stealing an employee's credentials in a phishing attack. The intrusion exposed customer business and contact information, employee data, and corporate files, while the company said the incident did **not** affect operations, hospital customer networks, or its core robotic surgery and digital platforms, including **da Vinci** and **Ion** systems. Intuitive said its robotic systems operate independently from the compromised internal business network and that hospital environments remain separately managed. The company said it took immediate containment steps, launched an ongoing investigation, and notified data privacy regulators. Reporting also noted that Intuitive's network segmentation separated internal IT business systems, manufacturing operations, and digital products, which the company cited as the reason the breach did not spread into production or customer-facing clinical environments. Public details remain limited, including when the phishing attack occurred and when it was detected, but both reports indicate the incident was confined to internal business applications rather than operational or medical device infrastructure.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026