Patients across the U.S. have been opening breach letters about their health data this autumn. Since early September, healthcare data breaches have been disclosed by heart-monitor maker iRhythm, Medi-Cal billing contractor Paradigm Healthcare Services, Ridgeway Pharmacy, the law firm Tarter Krinsky & Drogin and the electronic health record company Veradigm, while Maryland’s Luminis Health is being sued over a cyberattack.
Where it stands: The iRhythm count is the moving number. The Record reported on October 9 that iRhythm said “at least 360,000 people” were affected, based on Texas and South Carolina filings. By October 19, The HIPAA Journal reported that Oregon’s attorney general had listed the breach as involving 8,179,772 individuals. iRhythm had not publicly confirmed a total.
Healthcare data breaches this autumn, side by side
| Organization | Count as reported | Source of the count |
|---|---|---|
| iRhythm (Zio heart monitors) | At least 360,000; Oregon list shows 8,179,772 | State filings |
| Paradigm Healthcare (Medi-Cal billing) | More than 970,000 | HHS filing |
| Ridgeway Pharmacy | More than 258,000 | HHS filing |
| Tarter Krinsky & Drogin (law firm) | More than 196,000 | HHS filing |
| Veradigm | “Small number of customers”; gang claims 3.5 million patients | Company vs. gang claim |
| Luminis Health | No count; lawsuit alleges tens of thousands | Lawsuit allegation |
A filing count is what the organization told a regulator; it can grow as investigations finish. A gang claim is an unverified boast. Keep the two apart when you read any headline number.
iRhythm: insurance numbers and device serials
iRhythm makes the Zio wearable heart monitor. Its investigation found attackers were inside between June 3 and June 8, after reaching “unidentified third-party-hosted business applications through a social engineering attack,” The Record reported.
The stolen fields read like a patient’s file header: contact details and birth dates, iRhythm account and device serial numbers, insurance numbers and the dates care was given. A company spokesperson said clinical systems and medical devices were not affected. In its June disclosure to investors, iRhythm said the attackers had asked to be paid “in exchange for not publicly disclosing this information.”
On counts, The Record cited 298,647 people in Texas and 69,526 in South Carolina, plus notices filed in California. Oregon’s public breach list then recorded an iRhythm notice, reported October 6, with 8,179,772 affected. Oregon’s own disclaimer says its list reflects “the information given by an entity in their initial breach report,” so treat it as iRhythm’s filed figure, not a final audit.
Paradigm and the Medi-Cal member IDs
Paradigm Healthcare Services processes billing for Medi-Cal, California’s Medicaid program, under an agreement with the state Department of Health Care Services. Its sample letter, posted by the California attorney general, says it learned of unauthorized network access on October 13, 2025. It took until August 18, 2026 to determine that patient data was potentially accessed between October 8, 2025, and October 15, 2025.
The data is narrow but sensitive: a person’s name, birth date and gender, plus their Medi-Cal ID. SecurityWeek notes the letters went out “roughly 11 months after the intrusion was detected,” and that the notice does not say whether data was exfiltrated or who was behind it. Paradigm says it has no evidence of fraud tied to the incident.
Ridgeway Pharmacy and a law firm
Two smaller entries on the federal breach tracker deserve attention because of what was involved. Ridgeway Pharmacy told HHS more than 258,000 people were affected after its website was hacked. Per SecurityWeek, the exposed fields may include prescription details, health and insurance information and payment card information. That last item makes Ridgeway different from the rest of this list: card statements are worth checking now.
Tarter Krinsky & Drogin, a law firm that works for healthcare providers, began notifying people in early September. SecurityWeek says it spotted suspicious activity on its network in September 2025 and later found attackers had reached some servers between July 9 and September 9, 2025. It told HHS more than 196,000 individuals were affected.
Veradigm: a claim versus a filing
Veradigm, formerly Allscripts, told investors that an unauthorized party used vendor credentials to download patient data. Its filing says this included “in some instances, Social Security numbers; no clinical or medical data was involved.”
The Gentlemen ransomware gang listed Veradigm on its leak site claiming it had stolen records of 3.5 million patients. Veradigm’s account is very different: it says only a small number of customers were affected and that it is notifying people, with credit monitoring “where applicable.” No independent source has verified the gang’s number.
Luminis Health: allegations, not findings
In Maryland, patients of Luminis Health, which runs Anne Arundel Medical Center, filed a proposed class action after a cyberattack. The complaint alleges patient data sat in “an unencrypted, Internet-accessible environment” and asks for at least 10 years of credit monitoring. Those are claims a court has not tested.
Luminis says “the recent cyber incident did not affect the system that stores/hosts our patient records,” and has promised to tell patients if its investigation shows their protected information was touched.
What patients should check first
Medical identity theft shows up in bills and insurance records long before it shows up on a credit report. Start there. For more depth, see our guide to protecting insurance and patient accounts after a medical breach.
- Read every explanation of benefits. Paradigm’s letter tells recipients to review the explanation of benefits statements from their insurer and query anything unfamiliar. A service you never received is the classic red flag.
- Ask for a claims history. The same letter suggests asking your insurer for “a current year-to-date report of all services paid for you as a beneficiary.”
- Pull your credit reports. Reports are free at annualcreditreport.com or by calling 1-877-322-8228. Look for medical collections or accounts you do not recognize.
- Freeze or alert if your SSN was in play. Veradigm’s filing mentions Social Security numbers for some patients. A free credit freeze at all three bureaus blocks most new-account fraud; a fraud alert is a lighter option.
- Ridgeway customers: watch the card. Report unfamiliar charges to your card issuer and ask for a replacement card if anything looks off.
- Take the free monitoring, then judge it. Our breakdown of what credit monitoring costs after a medical breach explains what these offers do and do not cover.
If you find fraud, report it to the FTC at ftc.gov/idtheft or 1-877-438-4338, the contacts printed in Paradigm’s notice. Other breaches from this period appear in our October 2026 roundup.
Frequently Asked Questions
How many people did the iRhythm breach affect?
It depends on which filing you read. The Record reported at least 360,000 people based on Texas and South Carolina notices. The HIPAA Journal later reported that the Oregon Attorney General lists the breach as involving 8,179,772 individuals. iRhythm had not publicly confirmed a total, and the HHS portal did not yet show the incident.
What data was taken in the Paradigm Healthcare Medi-Cal breach?
According to the notice letter, each member’s name, birth date and gender together with the Medi-Cal ID number. Paradigm says the access happened in October 2025 and that it has no evidence the information was used for fraud.
Is the Veradigm breach 3.5 million patients?
That number is a claim by the Gentlemen ransomware gang, not a confirmed count. Veradigm says a small number of customers were affected and that, in some cases, patient Social Security numbers were downloaded.
What should I do if I get a healthcare data breach letter?
Read your explanation of benefits statements for care you did not receive, ask your insurer for a list of services paid in your name, pull your free credit reports, and consider a fraud alert or credit freeze if your Social Security number was involved. Enroll in any free monitoring before the deadline in the letter.
Sources
- Hundreds of thousands impacted by data breach at biosensor firm iRhythm — The Record (Recorded Future News, Jonathan Greig), October 9, 2026
- iRhythm Data Breach Affects 8.2 Million Individuals — The HIPAA Journal (Steve Alder), October 19, 2026
- Data Security Breaches (list of notices filed with the Oregon Attorney General) — Oregon Department of Justice, live list, checked October 21, 2026
- 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach — SecurityWeek (Eduard Kovacs), not shown on cached page (after September 21, 2026)
- Paradigm Healthcare Services: Notice of Data Breach (sample letter filed with the California Attorney General) — Paradigm Healthcare Services, via the California Attorney General, September 14, 2026
- Electronic health record company says customer data stolen in breach — The Record (Recorded Future News, Jonathan Greig), September 9, 2026
- Veradigm warns of patient data breach after ransomware gang claims attack — BleepingComputer (Bill Toulas), September 9, 2026
- Anne Arundel patients sue Luminis Health after cyberattack exposes medical data — The Baltimore Banner (Matti Gellman, Cody Boteler), September 16, 2026 (updated September 17, 2026)
- Luminis Health faces class-action lawsuit as cyberattack exposes patient data — FOX45 Baltimore (WBFF), September 18, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.