Wearable health tech startup ultrahuman said hackers gained unauthorized access to customer wellness data after stealing an employee’s credentials using malware.
On Wednesday, the India-based startup informed affected customers about the incident via email, stating that the breach occurred on March 27 and involved a system used for internal analysis. The company said it detected the intrusion quickly, took the affected system offline and revoked all access.
Founded in 2019, Ultrahuman sells smart rings and metabolic health tracking devices that allow users to monitor metrics such as sleep, activity, and recovery. The startup is best known for its air ringwhich competes with the Oura Ring, and recently introduced the Ring Pro with improved sensors and battery life.
Confirming the incident, Ultrahuman told TechCrunch that the attackers gained access using credentials stolen from an employee’s malware-infected laptop, resulting in access to wellness data belonging to approximately 0.1% of users.
Based on the figure previously reported by the company approximately 700,000 monthly active usersthat would equate to at least 700 customers having their health data accessed. Ultrahuman did not dispute this figure, but declined to disclose the exact number of customers affected. The company said no passwords, payment information, production systems or Ultrahuman Ring devices were compromised.
“Our security alert systems detected the incident within hours and we closed the vulnerability quickly,” Ultrahuman CEO Mohit Kumar said in a statement to TechCrunch.
Kumar added that the startup was notifying regulators and had delayed informing affected users while it audited the full scope of the incident and determined what data had been affected.
Ultrahuman declined to share details about whether it received any communications from the hackers responsible for the incident, or to say what exactly constitutes “wellbeing data.” The breach highlights how wellness tracking startups, such as Ultrahuman and Oura, store user data on their servers in a way that allows their employees, as well as governments and malicious hackers, to access customers’ health data.
The startup said in an FAQ. published on its website that the threat actor gained “read-only” access to the affected system. However, the company declined to confirm whether its investigation had determined whether any customer data was exfiltrated.
Ultrahuman counts Nexus Venture Partners, Steadview Capital and Blume Ventures among its investors. The startup has raised around 103 million dollars to date, according to Tracxn.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
