People whose information iRhythm Technologies held, including Zio heart monitor patients notified of the June 2026 breach, may be covered by proposed class actions alleging iRhythm failed to protect data taken in a cyberattack. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes proposed class action complaints. The claims in them are unproven allegations. iRhythm has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What the iRhythm Lawsuits Are About
iRhythm, the San Francisco company that makes Zio wearable heart monitors, disclosed in June 2026 that a threat actor took data from business applications it used that are hosted by third parties. In its quarterly report for the period ending June 30, 2026, iRhythm said three proposed class actions over the incident were filed that June in the U.S. District Court for the Northern District of California, San Francisco Division. Two name iRhythm Holdings, Inc. and one names iRhythm Technologies, Inc.The court's case listing now shows the matter as In re iRhythm Holdings, Inc. Data Breach Litigation, No. 3:26-cv-06070, before U.S. District Judge Trina L. Thompson. iRhythm told investors it is evaluating the allegations and its potential defenses. No class has been certified, no settlement has been announced and there is nothing to claim.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What iRhythm Says Happened
According to iRhythm's June 2026 Form 8-K, the company identified unauthorized activity on June 8, 2026. The next day, a threat actor contacted the company, claimed to have proprietary data, patient health information and other personal information, and demanded payment in exchange for not publishing it. iRhythm confirmed that data had been taken and said the attacker got it through social engineering. On June 10 the company decided the incident was material because of how much data was potentially involved.The notice letter iRhythm later sent to individuals says unauthorized people accessed and downloaded data between June 3 and June 8, 2026. iRhythm says it found no impact on its products, clinical or medical device systems, or patient safety.
Timeline
- June 3–8, 2026: Data downloaded from third-party-hosted business applications, per the notice letter.
- June 8, 2026: iRhythm detects the unauthorized access.
- June 9, 2026: A threat actor contacts iRhythm and demands payment.
- June 10, 2026: iRhythm determines the incident is material.
- June 15, 2026: iRhythm files a Form 8-K disclosing the incident.
- June 2026: Three proposed class actions are filed in San Francisco federal court.
- October 2, 2026: Date on the notice letters to affected individuals.
- October 6, 2026: The breach is reported to the California and Oregon attorneys general.
What Information Was Involved
The notice letter says the data may include a person's name, address, email address and phone number, iRhythm account number, iRhythm device serial number, patient insurance number, date of service and date of birth. The letter does not list Social Security numbers or financial account information. iRhythm says it has no evidence that anyone's information has been or will be used for identity theft.Who Is Affected
The Oregon Department of Justice breach list shows 8,179,772 people affected in total. The letters went to people whose data iRhythm stores, and the fields involved, such as device serial numbers and dates of service, point to patients who used Zio monitors. The breach was also reported to the California Attorney General on October 6, 2026.What the Notice Letter Offers
The sample letter filed with the California Attorney General does not include a credit monitoring or identity protection enrollment code. It lays out steps for protecting medical information, placing a fraud alert or security freeze with the three credit bureaus, and getting free credit reports. It also lists a dedicated call center for questions about the incident.What Happens Next
In its quarterly report, iRhythm said it expected the court to consolidate the cases and appoint interim lead counsel for the plaintiffs. In federal data breach litigation, consolidation is usually followed by a single amended complaint and a motion to dismiss before any discussion of class certification or settlement. iRhythm has said it cannot predict the outcome or estimate the potential impact.Is There Anything to Claim?
No. There is no settlement, claim form or settlement website. A proposed class covers everyone who fits its definition, so there is no sign-up step while the case is pending. If the case settles, a court-approved notice would explain who qualifies and how to file.Questions
Is the iRhythm data breach lawsuit the same as the iRhythm securities settlement?
No. The $45 million iRhythm securities settlement resolves an earlier investor class action, Glazing Employers and Glaziers' Union Local #27 Pension and Retirement Fund v. iRhythm Technologies, Inc., No. 3:24-cv-00706, over statements made to shareholders. The data breach suits are separate cases brought on behalf of people whose personal information was taken in the June 2026 incident.
Did iRhythm pay the hackers' ransom demand?
iRhythm has not said. Its June 2026 SEC filing reports that a threat actor contacted the company on June 9, 2026 and demanded payment in exchange for not publishing the data, but the filing does not say whether any payment was made.
Were Zio heart monitors or patient care affected by the iRhythm breach?
iRhythm says no. Its SEC filing states it had not identified any impact to its products, clinical or medical device systems, or patient safety, and that the incident involved third-party-hosted business applications rather than medical device systems.
Does the iRhythm notice letter offer free credit monitoring?
The sample letter iRhythm filed with the California Attorney General does not include a credit monitoring or identity protection enrollment offer. It describes fraud alerts, security freezes and free annual credit reports, and lists a dedicated call center for questions.
Sources
- iRhythm Holdings Form 8-K, Item 1.05 (report dated June 10, 2026; filed June 15, 2026)
- iRhythm Holdings Form 10-Q for the quarter ended June 30, 2026, Legal Proceedings
- California Attorney General breach report and sample notice letter (letter dated October 2, 2026)
- Oregon Department of Justice data breach list (8,179,772 affected)
- U.S. District Court for the Northern District of California, In re iRhythm Holdings, Inc. Data Breach Litigation, No. 3:26-cv-06070
