Ultrahuman says hackers accessed customers’ wellness data via internal tool

“Our security alerting systems detected the incident within hours, and we closed the vulnerability swiftly,” Ultrahuman CEO Mohit Kumar said in a statement to TechCrunch.

Kumar added that the startup was notifying regulators and had delayed informing affected users while it audited the full scope of the incident and determined what data had been affected.

Ultrahuman declined to share any details on whether it received any communication from the hackers responsible for the incident and didn’t say what exactly constitutes “wellness data.” The breach highlights how wellness tracker startups, like Ultrahuman and Oura, store users’ data on their servers in a way that allows their employees — as well as governments and malicious hackers — to access customers’ health data.

The startup said in an FAQ published on its website that the threat actor obtained “read-only” access to the affected system. However, the company declined to confirm whether its investigation had determined if any customer data was exfiltrated.

Ultrahuman counts Nexus Venture Partners, Steadview Capital, and Blume Ventures among its investors. The startup has raised around $103 million to date, per Tracxn.