Ultrahuman says an unauthorized third party accessed customer information in a security incident tied to one of its internal systems, raising fresh concerns about how much personal data wearable companies hold. The company says the breach happened on March 27, 2026, and involved an internal analytics tool rather than the app, the ring itself, or its production systems.
According to Ultrahuman’s public security notice, the intruder had “read-only” access, meaning the data could be viewed but not changed or deleted. Ultrahuman says it took the affected system offline and revoked access after detecting the incident, and it later emailed affected users beginning on or after June 2.
The company says the information involved varied by user. In some cases, it included contact and account details, plus order and transaction history. For a smaller group of users, the exposed data also included fitness-related information connected to product usage and purchases. Ultrahuman says no passwords, payment data, credit card information, or bank credentials were part of the incident.
Ultrahuman also says it has found no evidence so far that the accessed data has been misused, published, or offered for sale online. The company says it has notified relevant regulators and has added tighter access controls, stronger security on employee devices, more audits of internal tools, and new alerts meant to detect unusual data exports.
For users, the biggest advice is simple: be careful with unexpected emails, texts, or calls that mention Ultrahuman, orders, or personal information. The company says it will not ask customers to confirm passwords, payment details, or health data by email or SMS.
Source: Ultrahuman
