Ultrahuman reports data breach affecting small subset of users

The India-based health tech startup Ultrahuman has confirmed that hackers gained unauthorized access to customers’ wellness data. The security incident, which occurred on March 27, involved an internal system used by the company for analytics. On Wednesday, the startup began informing affected customers of the breach. According to the company, the unauthorized access was made possible after a threat actor stole an employee’s credentials through a malware-infected laptop. Upon detecting the intrusion promptly, Ultrahuman took the affected system offline and revoked all access.

The breach compromised the wellness data of about 0.1% of the startup’s user base. Based on Ultrahuman’s previously reported figure of roughly 700,000 monthly active users, this percentage equates to at least 700 customers who had their health data accessed. Ultrahuman did not dispute this figure but declined to disclose the exact number of customers affected. The company stated that the threat actor obtained only “read-only” access to the affected internal analytics system, and it declined to confirm whether its investigation had determined if any customer data was exfiltrated. The company also confirmed that no passwords, payment information, production systems, or Ultrahuman Ring devices were compromised during the incident.

In a statement, Ultrahuman CEO Mohit Kumar noted the speed of the company’s response: “Our security alerting systems detected the incident within hours, and we closed the vulnerability swiftly.” Kumar added that the startup was notifying regulators and had delayed informing affected users while it audited the full scope of the incident and determined what data had been affected. However, Ultrahuman declined to share any details on whether it received any communication from the hackers responsible for the incident, and did not specify what exactly constitutes “wellness data.”

Founded in 2019, Ultrahuman develops and sells smart rings and metabolic health-tracking devices that enable users to monitor metrics such as sleep, activity, and recovery. The startup is best known for its Ring Air, which competes with the Oura Ring, and recently introduced the Ring Pro with upgraded sensors and battery life. To date, the startup has raised around $103 million in total funding. Its investor base includes Nexus Venture Partners, Steadview Capital, and Blume Ventures.

Why it matters

The incident underscores the inherent privacy risks for wellness startups, where centralized data storage can potentially expose sensitive health metrics to employees, governments, or malicious actors.