iRhythm Holdings, Inc. (NASDAQ: IRTC) announced on Oct. 2, 2026, that it has begun notifying individuals affected by a cybersecurity incident first disclosed in June 2026, following the completion of a forensic investigation.

According to the company, unauthorized individuals accessed and downloaded data stored in certain third-party-hosted business applications between June 3 and June 8, 2026. iRhythm said it detected the unauthorized access on or around June 8, 2026, and activated its incident response plan.

The forensic review determined that the compromised data includes patient names, contact information such as addresses, email addresses, and phone numbers, iRhythm patient account numbers, device serial numbers, patient insurance numbers, dates of service, and dates of birth.

iRhythm stated it has no evidence that any personal information has been used or will be used to commit identity theft. The company said it does not store individual financial account information or payment card data.

The company added that the incident has not affected its products, clinical or medical device systems, customer connections, manufacturing and distribution operations, or patient safety. iRhythm said it continues to believe the incident is not reasonably likely to have a material impact on its financial condition or results of operations, consistent with a Form 8-K filed June 15, 2026.

iRhythm has established a call center for impacted individuals, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern time, excluding major U.S. holidays, at 1-844-770-7175. Notified individuals have been provided with guidance on steps to protect their personal information, including placing fraud alerts or security freezes on credit files and monitoring financial account statements.