Ultrahuman says hackers accessed customers’ wellness data via internal tool

Ultrahuman, a startup specializing in wearable health technology, has reported a data breach that compromised the wellness information of some of its customers. The incident occurred after hackers gained unauthorized access through stolen employee credentials, which were taken via malware. On Wednesday, the India-based company reached out to affected individuals via email to inform them of the breach, which took place on March 27 and involved an internal analytics system. The startup quickly detected the intrusion, took the affected system offline, and revoked access to ensure further security. Established in 2019, Ultrahuman is known for its smart rings and devices that track metabolic health, helping users monitor various metrics, including sleep patterns, physical activity, and recovery. Ultrahuman confirmed to TechCrunch that the attackers accessed data related to approximately 0.1% of its user base, which translates to around 700 customers based on the company's previously reported figure of roughly 700,000 monthly active users. While the startup did not provide the exact number of affected individuals, it reassured that no passwords, payment details, production systems, or Ring devices were compromised. CEO Mohit Kumar stated that their security alert systems detected the breach within hours, allowing the company to close the vulnerability swiftly. As part of their response, Ultrahuman is notifying regulators about the incident and initially delayed informing users while conducting a thorough audit to assess the extent of the breach. The company has not disclosed whether it received any communication from the hackers nor provided specific details on what constitutes the compromised 'wellness data.' This incident underscores the risks associated with wellness tracker startups, including Ultrahuman and competitors like Oura, that store sensitive health data on their servers, potentially exposing it to employees, governments, and malicious actors. In an FAQ on its website, Ultrahuman mentioned that the attackers gained 'read-only' access to the affected system but did not confirm if any customer data had been exfiltrated. The startup, which has raised approximately $103 million from investors such as Nexus Venture Partners, Steadview Capital, and Blume Ventures, is taking steps to enhance its security measures in the wake of this breach.