Indian wearable startup Ultrahuman—maker of the Ring Air competitor to Oura—confirmed in early June 2026 that attackers accessed customer wellness data through an internal analytics system. TechCrunch and Cybernews reported the intrusion occurred on March 27, 2026 after malware on an employee laptop stole credentials.
Scale: small but sensitive
Ultrahuman told reporters about 0.1% of users were affected—roughly 700 people against ~700,000 monthly actives. That is orders of magnitude smaller than mega-leaks, but health-adjacent data enables highly personalized scams (fake supplement offers, insurance lures citing real sleep scores).
What was and was not exposed
- Accessed: wellness/analytics fields for a small subset; contact details in notices
- Not accessed per company: passwords, payment cards, production systems, Ultrahuman Ring devices
Canonical record: Ultrahuman 2026 breach on BreachHistory.
Sources: Cybernews, Ultrahuman notice