Wearable health-tech startup Ultrahuman said hackers gained unauthorized access to customers’ wellness data after stealing an employee’s credentials through malware.
On Wednesday, the India-based startup informed affected customers of the incident via email, stating that the breach occurred on March 27 and involved a system used for internal analytics. The company said it detected the intrusion promptly, took the affected system offline, and revoked all access.
Founded in 2019, Ultrahuman sells smart rings and metabolic health-tracking devices that enable users to monitor metrics such as sleep, activity and recovery. The startup is best known for its Ring Air, which competes with the Oura Ring, and recently introduced the Ring Pro with upgraded sensors and battery life.
Confirming the incident, Ultrahuman told TechCrunch that the attackers gained access using credentials stolen from an employee’s malware-infected laptop, resulting in wellness data belonging to about 0.1% of users being accessed.
Based on the company’s previously reported figure of roughly 700,000 monthly active users, that would equate to at least 700 customers who had their health data accessed. Ultrahuman did not dispute this figure, but declined to disclose the exact number of customers affected. The company said no passwords, payment information, production systems, or Ultrahuman Ring devices were compromised.
“Our security alerting systems detected the incident within hours, and we closed the vulnerability swiftly,” Ultrahuman CEO Mohit Kumar said in a statement to TechCrunch.
Kumar added that the startup was notifying regulators and had delayed informing affected users while it audited the full scope of the incident and determined what data had been affected.
Ultrahuman declined to share any details on whether it received any communication from the hackers responsible for the incident, nor say what exactly constitutes “wellness data.” The breach highlights how wellness tracker startups, like Ultrahuman and also Oura, store users’ data on their servers in a way that allows their employees — as well as governments and malicious hackers — to access customers’ health data.
The startup said in an FAQ published on its website that the threat actor obtained “read-only” access to the affected system. However, the company declined to confirm whether its investigation had determined if any customer data was exfiltrated.
Ultrahuman counts Nexus Venture Partners, Steadview Capital, and Blume Ventures among its investors. The startup has raised around $103 million to date, per Tracxn.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Jagmeet covers startups, tech policy-related updates, and all other major tech-centric developments from India for TechCrunch. He previously worked as a principal correspondent at NDTV.
You can contact or verify outreach from Jagmeet by emailing mail@journalistjagmeet.com. View Bio June 18 Los Angeles Get an inside look at what it takes to scale and succeed from leaders at Mach Industries, Founders Fund, and Shinkei Systems. Through candid fireside chats and high-impact networking, you’ll walk away with valuable insights and new connections.
Most Popular Microsoft launches Scout, an OpenClaw-inspired personal assistant Russell Brandom
Anthropic files to go public Kirsten Korosec
‘What a joke’: GitHub Copilot’s new token-based billing spurs consternation among devs Lucas Ropek
I put Google’s 24/7 AI assistant Gemini Spark to work, and it’s actually pretty useful Sarah Perez
Blue Origin’s New Glenn rocket explodes during testing in Florida Sean O'Kane
Anthropic releases Opus 4.8 with new ‘dynamic workflow’ tool Russell Brandom
Waymo’s newest robotaxi is Chinese-made, built to make money, and now accepting riders Kirsten Korosec
---
**İlgili Kaynaklar:**
SEO ve GEO eğitim platformu ihtiyaçlarınız için [GEO eğitim](https://geoakademi.com) doğru adres.
