Have I Been Pwned says about 318,000 email addresses were in data ShinyHunters published after a 'pay or leak' campaign against US digital health company Sharecare (August 2026); no Sharecare statement found
Have I Been Pwned (HIBP) added Sharecare on 12 October 2026 (UTC; 13 October Perth time). HIBP says the digital health company was the target of a ShinyHunters 'pay or leak' extortion campaign in August 2026, and that the group then published data it claimed was taken from Sharecare's systems, containing about 318,000 unique email addresses.
HIBP says most of the data was business-to-business sales and marketing records with names, physical addresses, phone numbers, job titles and employers, and that it also included a small number of Brazilian health insurance plan members with dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer IDs).
When the data first appeared, BreachNews reported on 13 August that ShinyHunters claimed more than 3.4 million Salesforce records and more than 28 GB of internal data from Sharecare; those are the group's claims.
No public statement from Sharecare was found.
UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
- Product
- Sharecare (US digital health) — B2B sales and marketing contact records plus some Brazilian health plan member records
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Check your work address on Have I Been Pwned. Sharecare business contacts: expect targeted phishing that uses real names, employers and job titles, and confirm payment or account changes through a known phone number. Salesforce tenants: review connected apps and OAuth tokens, and limit bulk export rights.