Hackers Gain Access to Ultrahuman Customers' Wellness Data

Ultrahuman, a wearable health-tech startup, has exposed a data breach that compromised the sensitive wellness data of at least 700 customers. The breach occurred when hackers stole an employee's credentials through malware, which was used to gain 'read-only' access to the company's internal analytics system.

Ultrahuman's Delayed Disclosure Sparks Concern

The company first detected the breach on March 27 and promptly took the affected system offline, revoking all access. However, it took them several weeks to notify affected customers via email, sparking concern about the delayed disclosure.

"Our security alerting systems detected the incident within hours, and we closed the vulnerability swiftly," said Ultrahuman CEO Mohit Kumar in a statement to TechCrunch.

• The breach highlights the vulnerability of wellness tracker startups, such as Ultrahuman and Oura, which store users' data on their servers, allowing employees, governments, and malicious hackers to access customers' health data.

• The company has declined to share details on whether it received any communication from the hackers responsible for the incident or what exactly constitutes 'wellness data.'

• Ultrahuman counts Nexus Venture Partners, Steadview Capital, and Blume Ventures among its investors and has raised around $103 million to date, per Tracxn.

• The breach raises questions about the security measures in place at wellness tracker startups and whether they prioritize user data protection.

• The incident underscores the importance of transparency in data breaches, with Ultrahuman facing criticism for its delayed disclosure of the incident.

• The company's response to the breach has been met with skepticism, with some questioning whether it has taken adequate measures to prevent similar incidents in the future.