iRhythm Data Breach Lawsuit: Zio Patient Data, One Federal Case
Active Litigation
If you wore a Zio heart monitor, iRhythm Technologies holds your account, device and insurance details. Between June 3 and June 8, 2026 someone downloaded that data, and a threat actor demanded payment. Letters dated October 2, 2026 are now arriving. The Oregon Attorney General lists 8,179,772 people. The patient lawsuits have been combined into one federal case in San Francisco. As of October 22, 2026 there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by any company named on this page, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the iRhythm Data Breach
iRhythm makes the Zio wearable ECG patch that doctors prescribe to record heart rhythm. In its SEC filing the company says it found unauthorized activity on June 8, 2026 in business applications hosted by a third party, and that the data was obtained through social engineering. On June 9, 2026 a threat actor contacted the company, claimed to hold patient health information and demanded payment not to publish it. iRhythm confirmed data was exfiltrated and, on June 10, called the incident material.
Per the notice letter, the data was accessed and downloaded between June 3 and June 8, 2026 and may include: name, address, email, phone number, iRhythm account number, device serial number, patient insurance number, date of service and date of birth. iRhythm says the Zio devices, clinical systems and patient safety were not affected, and that it does not store payment card or bank account data. The lawsuits allege iRhythm failed to adequately protect this information.
Case details
The lead case is In re iRhythm Holdings, Inc. Data Breach Litigation, No. 3:26-cv-06070-TLT, in the U.S. District Court for the Northern District of California, before Judge Trina L. Thompson. It began as Cohen v. iRhythm Technologies, Inc., filed June 18, 2026 (docket on CourtListener).
On September 2, 2026 the judge consolidated it with Wickersham v. iRhythm Holdings, Inc., No. 26-cv-06095, and Dalessandro v. iRhythm Holdings, Inc., No. 3:26-cv-06263, and appointed interim class counsel. A later suit, Everett v. iRhythm Technologies, Inc., No. 3:26-cv-11872, was filed October 14, 2026.
Separate matter: a 2024 investor (securities) class action over FDA issues was settled for $45.0 million on June 3, 2026. It is about stock losses, not patient data, and pays nothing to Zio patients.
Status: Consolidated Case, No Settlement
The court order sets the next steps: plaintiffs must file a consolidated complaint by November 12, 2026, and iRhythm must respond by January 14, 2027. Those are filing deadlines for the lawyers, not for you. The scale is still settling too: the Oregon Attorney General lists 8,179,772 people, while Texas (298,647) and South Carolina (69,526) filings were the first state counts. As of HIPAA Journal’s October 19, 2026 report, the breach was not yet on the HHS Office for Civil Rights portal.
Follow this case
There's no claim deadline yet. We'll email you when the case moves forward, like a settlement or payments going out.
Am I Affected by the iRhythm Data Breach?
The practical test is a letter. iRhythm mailed notices dated October 2, 2026, branded Zio. If you wore a Zio monitor and got one, your data was in the downloaded set. Keep the letter and envelope: it is your proof if a class is ever certified or a settlement reached.
You do not need to sign up anywhere to be part of the proposed class. If the case settles, a court-appointed administrator would notify class members directly.
About the “iRhythm CyberScout letter”: the sample letter iRhythm filed with the California Attorney General does not mention CyberScout or offer credit monitoring. It recommends a fraud alert and a credit freeze instead. If your letter came via CyberScout or offers an enrollment code, check it against our guide to CyberScout breach letters and call the number printed in the iRhythm letter.
Is There Money From the iRhythm Lawsuit?
One factor matters for any future value: the notice lists no Social Security numbers, payment card or bank account data among the exposed items. It does list insurance numbers and device serial numbers. Settlements in comparable health-data cases have typically mixed reimbursement of documented losses with a smaller flat payment. Our data breach settlement calculator shows how those cases have paid out — as context, not a prediction.
How cases like this one end
Our copy of the federal courts’ own case database covers 16,001 other personal property damage casesclosed in U.S. federal district courts between 2015 and 2026, 11.3% of them filed as class actions:
- 32.5% ended in a settlement recorded by the court. Another 19.5% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 32.5% and 52.1%.
- 5.9% were decided on a motion before any trial.
- 1 in 90 reached a trial (1.1%), after a median of 27.5 months.
- Median time from filing to the end of the case: 8.4 months.
- Only 250 of them (1.6%) record a money award at all; the median of those is $443,000.
These are base rates for this type of case (federal other personal property damage cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
iRhythm Data Breach Timeline
June 3–8, 2026 — Data Downloaded
Per the notice letter, unauthorized individuals access and download patient data from third-party-hosted business applications. iRhythm detects the activity on June 8.
June 9–10, 2026 — Extortion and SEC Filing
A threat actor contacts iRhythm and demands payment. iRhythm confirms data was exfiltrated and, on June 10, determines the incident is material.
June 18, 2026 — First Patient Lawsuits
Cohen and Wickersham are filed in the Northern District of California; Dalessandro follows on June 23.
September 2, 2026 — Cases Consolidated
Judge Trina L. Thompson consolidates the suits as In re iRhythm Holdings, Inc. Data Breach Litigation, No. 3:26-cv-06070, and appoints interim class counsel.
October 2, 2026 — Notice Letters Mailed
Zio-branded letters go out. State filings follow; the Oregon Attorney General lists 8,179,772 affected people.
November 12, 2026 — Consolidated Complaint Due
Plaintiffs’ combined complaint is due by this date; iRhythm’s response is due by January 14, 2027. No settlement exists as of October 22, 2026.
Three Things to Watch For
The stolen data is exactly what a convincing impostor needs: your name, contact details, Zio device serial number and insurance number.
Calls or emails that quote your Zio details
Someone who knows your device serial number or date of service can sound like iRhythm or your cardiologist. Hang up and call the number printed in the iRhythm letter, 1-844-770-7175, or your doctor’s office directly.
“File your iRhythm settlement claim”
There is no iRhythm data breach settlement and no claims site. A page asking for your Social Security number or bank details to “secure your payment” is collecting data, not filing a claim.
Fake bills or insurance questions
With your insurance number exposed, watch for invoices or explanation-of-benefits entries for monitoring you never had. The October 2 notice letter does not ask you for any payment.
iRhythm Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is the iRhythm data breach letter real?
iRhythm mailed notices dated October 2, 2026, and filed a sample with the California Attorney General. The genuine letter is Zio-branded, describes access between June 3 and June 8, 2026, and lists a response line, 1-844-770-7175 (Monday to Friday, 8 am to 8 pm Eastern). It does not ask for payment or a Social Security number.
Is iRhythm a legit company?
Yes. iRhythm Holdings is a publicly traded medical-device company based in San Francisco, listed on Nasdaq as IRTC. It makes the Zio wearable heart monitor, which HIPAA Journal reports is used by about 8 million patients in the United States and Europe.
How many people were affected by the iRhythm data breach?
The Oregon Attorney General lists 8,179,772 individuals, per HIPAA Journal on October 19, 2026. Earlier state filings counted 298,647 Texas residents and 69,526 South Carolina residents. iRhythm itself has not published a national total, and as of that report the breach was not yet on the HHS portal.
What data was exposed?
Per the notice: name, address, email, phone number, iRhythm account number, device serial number, patient insurance number, date of service and date of birth. iRhythm says it does not store payment card or bank account information and that the Zio devices were not affected.
Is there an iRhythm data breach settlement or claim form?
No. As of October 22, 2026 the consolidated case, No. 3:26-cv-06070, is in early pretrial stages. There is no settlement, no fund and no claim form. The $45.0 million iRhythm settlement in the news is a separate investor case and does not pay patients.
Why didn’t the letter offer CyberScout credit monitoring?
The sample letter on file with the California Attorney General offers no credit monitoring and does not name CyberScout. It points you to a free fraud alert, a credit freeze and free credit reports. If your version differs, compare it with our CyberScout letter guide and call the iRhythm response line.
Why am I getting a bill from iRhythm Technologies?
A bill is a billing question, not part of the breach notice — this page cannot explain charges. Check it against your insurer’s explanation of benefits and call the number on your own account statement; be wary of any bill that asks for payment by unusual means after October 2026.
What should I do right now?
Keep the letter. Place a free fraud alert or credit freeze, as the letter suggests. Read your explanation-of-benefits statements for services you never received. You do not need to hire a lawyer or register anywhere to stay in the proposed class.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Is a CyberScout Letter Real?How to check a breach letter mailed through CyberScout
- Data Breach Settlement CalculatorEstimate what comparable breach settlements have paid
- Open Class Action SettlementsSettlements you can file a claim in right now
- Settlement Payout CalculatorHow a settlement fund gets divided per person