Ultrahuman Says March 27 Breach Affected 0.1% of Users, Contained Within Hours

Ultrahuman notified affected customers by email on Wednesday that hackers had gained unauthorized access to wellness data on March 27. The India-based startup said the breach occurred after credentials were stolen from a malware-infected employee laptop and involved a system used for internal analytics.

The company said its security alerting systems detected the incident within hours, took the affected system offline, and revoked all access.

Ultrahuman CEO Mohit Kumar said the threat actor obtained read-only access. 1 percent of Ultrahuman users was accessed.

With roughly 700,000 monthly active users, that figure equates to at least 700 customers. Ultrahuman declined to disclose the exact number of customers affected. No passwords, payment information, production systems, or Ultrahuman Ring devices were compromised.

The company said it had not determined whether any customer data was exfiltrated. Kumar said Ultrahuman was notifying regulators and had delayed informing affected users while it audited the full scope of the incident and determined what data had been affected. The company declined to share details on any communication from the threat actor and did not define what constitutes wellness data.

Ultrahuman was founded in 2019 and sells smart rings and metabolic health-tracking devices that enable users to monitor metrics such as sleep, activity, and recovery. The startup is best known for its Ring Air product and recently introduced the Ring Pro with upgraded sensors and battery life. Ultrahuman counts Nexus Venture Partners, Steadview Capital, and Blume Ventures among its investors.