Home / Technology / Hackers Access User Wellness Data Via Malware
Hackers Access User Wellness Data Via Malware
3 Jun
Summary
- Hackers stole employee credentials using malware to access data.
- Wellness data of about 700 customers was accessed.
- No payment information or device data was compromised.
Wearable health-tech startup Ultrahuman disclosed a data breach that occurred on March 27, 2026. Attackers gained unauthorized access to customer wellness data by stealing an employee's credentials through malware infection.
The breach targeted an internal analytics system. Ultrahuman detected the intrusion within hours, took the system offline, and revoked access to mitigate further risks. The company has since informed affected customers via email about the incident.
Approximately 0.1% of Ultrahuman's user base had their wellness data accessed, which could equate to at least 700 customers based on reported user numbers. Importantly, the company stated that no passwords, payment information, production systems, or Ultrahuman Ring devices were compromised during the incident.
Ultrahuman CEO Mohit Kumar confirmed the breach, noting that regulators were being notified. The company delayed informing users while auditing the full scope and determining the extent of data exfiltration, though they did not confirm if data was taken.
This incident highlights the security risks faced by wellness tracker startups storing sensitive user data. Ultrahuman's investigation indicated the threat actor had 'read-only' access to the affected system.
