iRhythm Technologies has disclosed that attackers stole data held in third-party applications during a cyberattack, the company confirmed in a statement reported by Healthcare Dive.

The disclosure marks the first confirmation that the incident extended beyond iRhythm's own systems. Attackers exfiltrated information from applications operated by external providers serving the company.

What did iRhythm confirm?

The company said data was taken from the third-party applications. It had previously disclosed the cyberattack but had not detailed the full scope of the compromise.

iRhythm provides cardiac monitoring devices and related data services. The company has not yet publicly specified the full categories of data affected or the identity of the third-party vendors involved.

Why does third-party involvement matter?

The breach illustrates the exposure that healthcare technology firms carry through their supplier ecosystems. Even when core systems remain intact, data accessible to vendors can be exfiltrated during an attack.

iRhythm has not stated how many patients or records are affected. The company also has not named the threat actor or described the intrusion method.

What happens next?

The company is expected to complete its review of the stolen data. Additional notifications to affected individuals and regulators may follow as that assessment concludes.