Wearable health-tech startup Ultrahuman disclosed that hackers gained unauthorized access to customers’ wellness data after stealing credentials from a malware-infected employee laptop, affecting approximately 0.1% of its user base.
The breach occurred on March 27, 2026, and was publicly disclosed on June 3, 2026, when the India-based company notified affected customers by email. The compromised system was an internal analytics tool. Ultrahuman said its security systems detected the intrusion within hours, after which the company took the affected system offline and revoked all access.
Based on Ultrahuman’s previously reported figure of roughly 700,000 monthly active users, the 0.1% figure equates to at least 700 customers whose health data was accessed. The company declined to confirm the exact number of affected users. Ultrahuman CEO Mohit Kumar stated that no passwords, payment information, production systems, or Ultrahuman Ring devices were compromised.
“Our security alerting systems detected the incident within hours, and we closed the vulnerability swiftly,” Kumar said in a statement to TechCrunch.
Founded in 2019, Ultrahuman sells smart rings and metabolic health-tracking devices, including its Ring Air and the recently introduced Ring Pro. The company said it has notified regulators and delayed informing affected users while it audited the full scope of the incident.
The company confirmed the threat actor had “read-only” access to the affected system but declined to say whether its investigation had determined if any customer data was actually exfiltrated. Ultrahuman also declined to clarify exactly what data falls under the category of “wellness data” or whether it had received any communication from the attackers.
The incident highlights a broader concern: wellness tracker companies store users’ health data on their servers in a way that may allow employees, governments, and malicious actors to access it. Ultrahuman has raised approximately $103 million to date, with investors including Nexus Venture Partners, Steadview Capital, and Blume Ventures.
Source: TechCrunch