In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
Government issued IDs
What to do if you had an account
Turn on two-step sign-in. Enable two-factor authentication where the service offers it, preferably with an authenticator app or a passkey. A leaked password alone is then not enough to get in.
Expect targeted phishing. Leaked details are used to write convincing fake messages that mention the breached company or your real name. Do not click links in unexpected emails or texts this account; go to the site by typing its address.
Watch for scam calls and SIM swaps. Be suspicious of calls and texts that claim to be from your bank or a courier. Ask your mobile operator for a port-out or SIM-change PIN if it offers one.
Guard against identity fraud. Identity documents and dates of birth cannot be changed like a password. Consider a credit freeze or fraud alert where your country offers one, and be wary of anyone who 'verifies' you using those details.
Check your email at haveibeenpwned.com
We do not run email lookups ourselves. The is done on haveibeenpwned.com, the service this list comes from.
Guides for this breach
What to do after a data breach The order that matters: email first, then passwords, two-step sign-in and your bank.
Phishing emails Leaked addresses get targeted scam emails that quote the breach. How to spot them.
Scam messages and calls What to expect when your phone number leaks, and how to block it.
Freeze your credit Stops new accounts being opened in your name with leaked identity data.
If money was taken Who to call first and how to dispute card and bank payments.
Follow the story: ShinyHunters and the Salesforce data theft wave
Companies whose customer data was taken from cloud platforms such as Salesforce and Snowflake, as each breach is published. 70 events so far, updated Oct 12, 2026 .
Sharecare breach published: 318,185 accounts Oct 12, 2026
Neogen breach published: 435,963 accounts Oct 9, 2026
CyrusOne breach published: 373,460 accounts Oct 7, 2026
See the full timeline →
Were you in the Sharecare breach?
Tell others what you noticed: a notice from the company, scam messages that quote it, or logins you did not make. Never post your email address or password here.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
