Threat Intelligence

Sharecare Data Breach: ShinyHunters Leak Puts 318K Business Contacts in HIBP

In short

In August 2026, ShinyHunters published data it says came from Sharecare, a digital health company, after a failed “pay or leak” negotiation.
Have I Been Pwned loaded the data on October 12, 2026: 318,185 unique email addresses, most of them from business sales and marketing records.
Those records hold names, physical addresses, phone numbers, job titles and employers. A small part covers members of a Brazilian health plan, with dates of birth and CPF taxpayer numbers.
We found no public statement from Sharecare. No passwords or medical records are listed.

Around August 13, 2026, the ShinyHunters group listed Sharecare on its leak site, claiming more than 3.4 million Salesforce records, some with personal information, and more than 28 GB of internal company data. It said no agreement was reached and published an archive of more than 25 GB. Sharecare was part of the same wave as Baxter, Cook Medical and Carhartt, according to BreachNews, which did not independently verify the claims.

On October 12, 2026, Have I Been Pwned (HIBP) loaded the data and marked it as verified: 318,185 unique email addresses. HIBP says most of it is business-to-business sales and marketing records, with names, physical addresses, phone numbers, job titles and employers. A small number of records belong to members of a Brazilian health insurance plan and add dates of birth, gender, marital status and CPF numbers, the Brazilian taxpayer ID. As of October 17, 2026, we found no public statement, regulatory filing or notification from Sharecare about the incident.

“Salesforce records” points to the group’s usual method this year: a phone call that persuades an employee to connect an attacker’s app to the company’s Salesforce account, which then lets the attacker export the customer and lead lists. We explain that pattern in our article on ShinyHunters’ 2026 pay-or-leak campaign. Sharecare has not said how its data was taken.

What the exposed data enables

Sales and marketing records are a list of real business relationships: who the contact is, where they work, their title and how to reach them. That is enough for a believable email or call “from Sharecare” about a wellness program, a renewal or an invoice. For the Brazilian plan members, a CPF together with a date of birth is useful for identity fraud, not only for phishing.

Does this touch your business?

If your company was a Sharecare customer, prospect or partner, or if HR or benefits staff ever talked to its sales team, their work details may be in this data. Expect messages that use Sharecare’s name and a real contact person to look legitimate. If none of your team ever dealt with Sharecare, the direct risk is low.

The wider lesson: the data that leaks is often not your customers’ accounts but your CRM, the list of everyone you sell to. Whoever can export it can impersonate you to all of them.

What to do this week

Check the addresses that matter. Run work addresses, especially HR, benefits and purchasing, through our free Am I Breached? checker and turn on alerts. The Sharecare breach page lists every field that was exposed.
Treat “Sharecare” messages with care. Confirm any request about payments, contracts or employee data with a contact you already know, by phone, before acting.
Review who can export your CRM. List the people and connected apps with export rights in your CRM, remove what is not needed, and tell staff never to approve an app connection because someone asked on the phone.

Frequently asked questions

Has Sharecare confirmed the breach?

We found no public statement from Sharecare as of October 17, 2026. Have I Been Pwned has marked the published data as verified.

Were medical records exposed?

None are listed. Most of the data is business contact information. A small part covers members of a Brazilian health plan, with dates of birth, gender, marital status and CPF numbers.

Were passwords exposed?

No passwords are listed in the data loaded by Have I Been Pwned.

How do I know if my email is in the Sharecare data?

Enter it in our free Am I Breached? checker, which uses Have I Been Pwned data, and turn on alerts.

Data from Have I Been Pwned | Sources: BreachNews | Written with AI assistance and checked against these sources on October 17, 2026

Found this useful? The next one can come to you.

We write now and then: practical security for a small business, the month's ransomware figures in plain language, and new free tools when they land. No spam, and one click to leave.

A tool by Digital Checkmark