iRhythm suffers extortion following a social engineering attack on third-party applications

What happened

iRhythm reported that an actor gained access through social engineering to third-party-hosted business applications and obtained potentially sensitive information. After the access, the company received an extortion demand, as recorded by Reuters in its review of recent attacks against US companies.

The attack did not compromise iRhythm's own infrastructure, but rather cloud applications managed by external providers to which the company had entrusted part of its data.

What it teaches companies relying on third-party applications

More and more critical functions run on applications hosted outside the organisation: management, HR, customer service. The security of that data depends both on the provider and on how the company manages its own access to those tools.

The fact that extortion followed the access confirms a common pattern: information is obtained first, then the victim is pressured financially with the threat of disclosure.

What to review

Relevant controls for third-party applications holding sensitive data:

• An inventory of cloud applications in use and the type of data they handle.
• Two-factor authentication and stronger verification for access to those applications, especially where health data is involved.
• Contractual clauses with the provider on notification and incident response.
• An action plan agreed in advance for an extortion demand, avoiding improvised decisions.

Frequently Asked Questions

How did the attackers gain access?

Through social engineering targeting third-party-hosted business applications, as reported by iRhythm.

What happened after the access?

The company received an extortion demand from the attackers.

Is the risk different when data sits in a provider's cloud?

The risk changes shape, not substance: access control, monitoring and a response plan agreed with the provider are still needed.