Have I Been Pwned loads 318,185 email addresses from Sharecare data published after a ShinyHunters 'pay or leak' extortion campaign against the US digital health company (breach August 2026)
Have I Been Pwned added Sharecare on 12 October 2026 (UTC; 13 October Perth time). It says the US digital health company was the target of a ShinyHunters 'pay or leak' extortion campaign in August 2026, after which the group published data it claimed was taken from Sharecare's systems. HIBP counts 318,185 unique email addresses. Most of the data is business-to-business sales and marketing records with names, physical addresses, phone numbers, job titles and employers, but it also includes a small number of Brazilian health insurance plan members with dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer IDs). HIBP lists the breach as verified. When the data first appeared, BreachNews reported on 13 August that ShinyHunters claimed more than 3.4 million Salesforce records and more than 28 GB of internal data from Sharecare, published as a 25 GB-plus archive after talks failed; those leak-site figures are the group's claims and were not independently verified. Sharecare was listed in the same wave as Baxter, Cook Medical and Carhartt. Sharecare has not been quoted on the data. Primary: Have I Been Pwned; background: BreachNews.
- Product
- Sharecare (US digital health) — B2B sales and marketing contact records plus some Brazilian health plan member records
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Check your work address on Have I Been Pwned. Sharecare business contacts: expect targeted phishing that uses real names, employers and job titles, and confirm payment or account changes through a known phone number. Salesforce tenants: review connected apps and OAuth tokens, and limit bulk export rights.
Primary: Have I Been Pwned — Sharecare breach (added 12 Oct 2026 UTC; breach 12 Aug 2026) · BreachNews — ShinyHunters claims Baxter breach, publishes Cook Medical, Carhartt and Sharecare data (13 Aug 2026)