Breaches and incidents
Ultrahuman (India): infostealer-stolen employee credentials expose wellness data via internal analytics tool
The India-based smart-ring maker told TechCrunch attackers accessed an internal analytics system on 27 Mar 2026 and read customers’ wellness data, contact...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- The India-based smart-ring maker told TechCrunch attackers accessed an internal analytics system on 27 Mar 2026 and read customers’ wellness data, contact details and transaction history; about 0.1% of users (at least 700 by MediaNama’s estimate) affected. No passwords, payment data, production systems or rings affected, per the company; users were emailed on 3 Jun.
- Root cause: login credentials stolen from an employee laptop infected with malware, then used on the analytics system.
- Attacker: unidentified; company declined to say if it was contacted.
- Response: system taken offline, all access revoked, regulators being notified per the company.