ShinyHunters Leaks 318k Sharecare Records, Exposing Brazilian IDs After Failed Extortion
The cybercrime group published data from the digital health firm after an August 2026 extortion campaign, exposing sales contacts and Brazilian user IDs.
Key points
- ShinyHunters published 318,185 records from Sharecare following an August 2026 extortion attempt.
- Exposed data includes B2B sales records and Brazilian health insurance member details with government IDs.
- Troy Hunt’s Have I Been Pwned verified the breach and added it to its database in October 2026.
The cybercrime group ShinyHunters published data it claimed was stolen from digital health company Sharecare. This release followed a "pay or leak" extortion campaign that targeted the organization in August 2026. The group stated it obtained the information from Sharecare’s systems before making it public.
At a glance
- Organisation
- Sharecare
- Accounts affected
- 318,185
- Breach date
- August 12, 2026
- Added to HIBP
- October 12, 2026
- Verified
- Yes
- Data exposed
- Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles
According to the breach record on Have I Been Pwned, the exposed dataset contains 318,185 unique email addresses. The database entry, added on October 12, 2026, confirms the incident as verified. The leak primarily consists of business-to-business sales and marketing records rather than general consumer health data.
Context and Background
ShinyHunters is known for conducting extortion campaigns where they threaten to release stolen data unless a ransom is paid. In this case, the group proceeded to publish the information after the August 2026 campaign. The published data is described as containing records from Sharecare’s internal systems.
The majority of the compromised information relates to professional contacts. This includes names, physical addresses, phone numbers, job titles, and employers. These details suggest the data was sourced from sales or marketing departments rather than patient care systems.
Who Is Affected
While most records are B2B contacts, a small subset involves Brazilian health insurance plan members. These specific records contain more sensitive personal information. The data includes dates of birth, genders, and marital statuses for these individuals.
Critically, the Brazilian records also contain CPF numbers. These are Brazilian taxpayer identification numbers, which function as government-issued IDs. The exposure of such identifiers can facilitate identity theft or fraud in the affected region.
The full list of exposed data types includes names, email addresses, physical addresses, phone numbers, employers, job titles, dates of birth, genders, marital statuses, and government issued IDs. The breach date is recorded as August 12, 2026.
What should you do?
Individuals who find their email addresses in the Have I Been Pwned database should monitor their accounts for suspicious activity. Those with exposed CPF numbers should contact Brazilian financial authorities to check for fraudulent applications. Organizations should review their sales data handling procedures to prevent similar leaks.
What to do and how to stay safe: Sharecare
- Check if your email address appears in the Have I Been Pwned database for this specific breach.
- Monitor bank and credit statements for unauthorized transactions, especially if you are in Brazil.
- Enable multi-factor authentication on all associated accounts to reduce the risk of credential stuffing.
- Be vigilant against phishing emails that may use the leaked personal data to appear legitimate.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many records were exposed in the Sharecare breach?
The breach exposed 318,185 unique email addresses, according to the Have I Been Pwned record.
What specific data was leaked from Sharecare?
The leak includes names, emails, phone numbers, job titles, employers, and for some Brazilian users, CPF numbers and birth dates.
When did the Sharecare breach occur?
The breach date is listed as August 12, 2026, with the data added to Have I Been Pwned in October 2026.
