Medical equipment provider iRhythm is notifying more than 360,000 people that hackers stole their personal information.
The data breach was identified on June 8 and involved third-party-hosted business applications that stored certain iRhythm information, the company says.
During its investigation into the incident, iRhythm determined that hackers accessed and exfiltrated patient data from the affected applications between June 3 and June 8.
The compromised information includes patients’ names, addresses, email addresses, dates of birth, and phone numbers, as well as iRhythm account and device data, such as account numbers, serial numbers, insurance numbers, and dates of service.
Based on data breach notices iRhythm filed last week with regulators in several states, at least 360,000 individuals (298,647 in Texas and 69,526 in South Carolina) were affected. The total number of impacted patients is likely significantly higher.
In a June filing with the Securities and Exchange Commission (SEC), the company said the hackers contacted it on June 9, threatening to leak the stolen information online unless a ransom was paid.
Last week, iRhythm said it currently has no evidence that the stolen information “has been or will be used to commit identity theft,” which suggests that it gave in to the extortionists.