Key points
- ShinyHunters leaked data from Sharecare following an August 2026 extortion attempt.
- The breach exposed 318,185 records, mostly B2B sales contacts with limited health data.
- A small subset of Brazilian users had CPF numbers and marital status revealed.
The digital health company Sharecare became the target of a data extortion campaign in August 2026, according to breach records. The threat group ShinyHunters subsequently published information it claimed to have stolen from Sharecare’s systems. This publication included 318,185 unique email addresses and associated personal details. The incident was added to the Have I Been Pwned database in October 2026, confirming the exposure.
In plain English
The leaked dataset primarily contains business-to-business sales and marketing records. According to the source material, these records include names, physical addresses, phone numbers, job titles, and employer information. This means the majority of affected individuals are likely professionals whose contact details were exposed. The group described the event as a "pay or leak" scenario, implying they demanded payment before releasing the data publicly.
The background
While most of the data is professional, a smaller portion involves sensitive personal information. The source material notes that the leak included a small number of Brazilian health insurance plan members. For these specific individuals, the exposed data went beyond contact details to include dates of birth, genders, marital statuses, and CPF numbers. CPF numbers are Brazilian taxpayer identification numbers, which are government-issued IDs used for financial and legal purposes in Brazil.
What changes now
Organizations that interacted with Sharecare for sales or marketing purposes may have had their employees' data exposed. Security teams should verify if any staff contacts appear in this dataset. For the Brazilian users identified, the exposure of government IDs and marital status presents a higher identity theft risk. No patch or fix has been confirmed yet for the underlying vulnerability that allowed this access, as the material focuses on the aftermath of the leak.
Background: Have I Been Pwned
Have I Been Pwned checks if your email or phone number appears in known data breaches. It tells you which services were compromised and when. Use this history to reset passwords and enable multi-factor authentication on affected accounts immediately. It does not scan your device or monitor live traffic.
Read the full guide: Have I Been Pwned FAQs: Data Scope, API Safety, and False Positives
What to do and how to stay safe: Sharecare
- Check if your email address appears in the Have I Been Pwned database to confirm exposure.
- Monitor financial accounts and credit reports for unusual activity, especially if you are in Brazil.
- Be alert for phishing emails that use the leaked personal details to appear legitimate.
- Review shared personal information with third-party vendors to understand data handling practices.
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was leaked from Sharecare?
The leak included email addresses, names, physical addresses, phone numbers, job titles, and employers for most records.
Were any government IDs exposed in this breach?
Yes, CPF numbers, which are Brazilian taxpayer identification numbers, were exposed for a small number of Brazilian health insurance members.
Who is responsible for the Sharecare data leak?
The ShinyHunters threat group claimed responsibility for the extortion campaign and the subsequent publication of the data.
