iRhythm makes wearable cardiac monitors. In June it told the Securities and Exchange Commission that it had been breached. On 2 October it began telling the patients.

The June filing

The company filed an 8-K under Item 1.05, the rule requiring disclosure of material cybersecurity incidents.

The sequence in the filing is tight. Unauthorised activity on 8 June. Contact from the threat actor on 9 June. On 10 June, the company determined the incident was material in light of the volume of the potentially affected data.

Data was accessed and downloaded from third-party-hosted business applications between 3 and 8 June. The actor demanded payment in exchange for not disclosing it. iRhythm has not said whether it paid.

Read the materiality sentence again, because it does a lot of work. On 10 June the company knew enough about the volume to call the incident material to investors. Patient notification began on 2 October.

Four months

The stated reason for the four-month gap is the completion of a forensic investigation, and that is a real constraint rather than an excuse. Establishing which individuals are in a dataset pulled from multiple business applications is genuinely slow, and notifying the wrong people is its own harm.

But the two audiences got very different service. Investors were told in two days, on the basis of volume. Patients were told in sixteen weeks, on the basis of certainty.

That asymmetry is written into the rules rather than into this company. Securities disclosure is triggered by materiality to the business and runs on a four-day clock. Health breach notification is triggered by identification of individuals and runs on a sixty-day clock from discovery, with the usual arguments about when discovery is complete. Both were probably followed. The patient still finds out last.

The number nobody has published

iRhythm has not released a company-wide total.

What exists instead is state regulatory filings, and they have to be assembled by hand:

  • Texas: 298,647
  • South Carolina: 69,526

Those two states alone come to 368,173. One trade outlet describes the breach as affecting "at least 360,000". A separate aggregation of regulatory filings arrives at 8,179,772 nationwide — a figure the company has not confirmed and which comes from a tracker rather than a disclosure.

Between 368,000 confirmed in two states and an unconfirmed 8.2 million nationwide there is an enormous amount of room, and the only party able to close it is the one that has not.

This is the third time in a fortnight we have had to write a paragraph like this. A university breach where the headline number was the size of the database, a ransomware quarter where nine in ten entries were unverified claims, and now a count that exists only as a sum of state filings. The scale of a breach is routinely the least reliable fact reported about it.

The data was not on iRhythm's systems

One line in the filing is easy to read past: the data was taken from third-party-hosted business applications.

So this is not a breach of a medical device company's clinical systems. It is a breach of software iRhythm buys, holding data iRhythm put there — which is why the company can say its products, device systems and manufacturing were unaffected and be entirely accurate while hundreds of thousands of patient records are gone.

Two things follow. The first is that the organisation naming the incident is not necessarily the organisation that was broken into, and the public record will carry iRhythm's name rather than the vendor's. The second is that other customers of the same applications may be in the same position and may not know, because nothing obliges the party in the middle to say which product it was.

Neither the filing nor the notification names the applications.

What was taken, and what that is worth

Names, contact details, dates of birth, insurance numbers, device serial numbers and dates of service. The company says it does not store individual financial account or payment card data.

The device serial number is the unusual entry. Combined with a name and a date of service, it identifies not just a person but a person who wore a cardiac monitor on a particular date — which is a medical fact about them, inferable without any clinical record being taken.

iRhythm says it has no evidence the information has been or will be used to commit identity theft, and that the incident did not affect its products, medical device systems, manufacturing or patient safety.

What to do

  • If you have worn one of these monitors, the exposure to act on is targeted phishing. Someone with your name, date of birth, insurance number and date of service can sound exactly like the clinic.
  • Insurance numbers are the item to watch for medical identity fraud, which shows up as claims rather than as credit activity.
  • For anyone running breach response: the gap between what you can tell investors and what you can tell affected people is a reputational problem even when both timelines are lawful. Saying publicly why the second is slower costs nothing.

What is not established

  • How many people were affected in total. The company has published no figure.
  • Whether the 8.2 million aggregation is accurate.
  • Whether a ransom was paid.
  • Who the attackers were.
  • Which third-party applications were involved, and whether other customers of those applications were affected.