Sharecare: ShinyHunters Leaks Data After Failed Pay-or-Leak Extortion

The ShinyHunters extortion group has published data it says it stole from Sharecare, the Atlanta-based digital health company behind the AskMD app. The group posted the data in mid-August 2026 after what it called failed "pay or leak" negotiations. On October 12, 2026, Have I Been Pwned (HIBP) loaded 318,185 unique email addresses from the leak and marked the breach as verified. That is the first independent sign that the dump holds real data. Public counts differ widely. HIBP counts 318,185 unique emails. DataBreach.com indexed 565,222 rows. ShinyHunters claims more than 3.4 million Salesforce records plus over 28 GB of internal files, which nobody has verified. As of mid-October, none of the sources found any public statement, regulatory filing or breach notification from Sharecare.

What Happened

The leak site listing and the HIBP load give this timeline:

• August 12 or 13, 2026: The estimated attack date. 2-Spyware's breach page gives August 12. DataBreach.com, citing the monitoring site Ransomware.live, gives August 13, based on the "updated" date on the published archive.
• About August 13 to 14, 2026: ShinyHunters names Sharecare on its leak site. Ransomware.live and dark web tracker DeXpose reported the listing on August 14. The group said no agreement was reached and published an archive digitalchk puts at more than 25 GB. According to emailexpert, the group blamed Sharecare's negotiator for the failed talks.
• August 17, 2026: ClassAction.org reported that attorneys were looking into a possible class action. At that point no details about the scope had been confirmed (per DataBreach.com).
• October 12, 2026: HIBP adds the dataset: 318,185 unique email addresses, marked verified.

Sharecare was listed in the same August wave as Baxter, Cook Medical and Carhartt, according to BreachNews (cited by digitalchk), which did not verify the group's claims. Other HIBP loads from ShinyHunters pay-or-leak cases follow the same pattern: Neogen (436k emails, August 2026) and Crunchbase (560k emails, January 2026). In each case the leaked data was mostly corporate contact and lead records.

Sharecare has said nothing publicly. Digitalchk (as of October 17), DataBreach.com (as of October 14) and emailexpert all report finding no statement. Sharecare has not confirmed the breach, explained how the data was taken, or said whether the affected Brazilian plan members have been told.

What Was Taken

The record counts vary by source and by what is being counted:

These numbers do not necessarily contradict each other. HIBP counts unique email addresses. DataBreach.com counts rows, many of which may have a name and address but no email. ShinyHunters' 3.4 million figure is the actor's own claim and may include duplicates, non-personal records, or data it never published.

HIBP's description, repeated by every secondary source, says the data includes:

• Mostly business-to-business sales and marketing records: names, physical addresses, phone numbers, job titles and employers.
• A small number of members of a Brazilian health insurance plan: dates of birth, gender, marital status and CPF numbers (Brazil's government-issued taxpayer ID).

No source lists passwords or medical records among the exposed data. That still leaves an open question: DataBreach.com lists birthdays among its indexed fields, and nobody has said how many Brazilian plan members are affected.

Why It Matters

This is a targeting list, not just a contact list. Sharecare sells to employers, health plans and healthcare providers. As emailexpert points out, what HIBP describes amounts to a list of the people Sharecare sells to, such as benefits managers and health plan staff, with their job titles and employers attached. These people expect vendor emails that mention their employer. A phishing email built from this data will look like ordinary sales mail. If it comes from a lookalike domain or a hijacked mailbox, it may also pass the authentication checks that would stop a forged sharecare.com address.

The CPF subset raises the stakes. Most of the dump is professional contact data. But Brazilian taxpayer IDs combined with dates of birth are valuable for identity fraud. This part of the leak may also bring obligations under Brazil's data protection law (LGPD). Sharecare has not said whether it has notified anyone.

Disclosure is lagging the leak. Two months after the data appeared on a leak site, the only independent confirmation comes from HIBP. Customers and partners should not wait for a company notification before treating their staff as exposed. Emailexpert also notes a previous incident: a 2018 intrusion at Sharecare's health data services unit went unnoticed for about a month.

It fits a sustained campaign. In 2026 ShinyHunters has repeatedly targeted Salesforce customers and published CRM exports when victims refuse to pay. Sharecare is one of several healthcare and life-sciences names in the August wave.

The Attack Technique

How the data was taken has not been confirmed. Sharecare has not disclosed an access vector, and no source ties this incident to a specific technique. What the sources offer is circumstantial:

• The Salesforce claim: ShinyHunters says the haul is Salesforce records. Digitalchk notes that the group's usual method this year is vishing: an attacker phones an employee and persuades them to authorize an attacker-controlled connected app in the company's Salesforce org, then exports the customer and lead lists through it. This is an analytical inference, not a confirmed finding for Sharecare.
• Experience Cloud misconfiguration: Emailexpert reports that in March 2026 Salesforce said ShinyHunters was exploiting misconfigured Experience Cloud guest user profiles. Emailexpert also states that nobody has linked Sharecare to that activity.
• Marketing stack: Emailexpert observed that Sharecare's SPF record authorizes Pardot, Salesforce's B2B marketing automation platform, which fits a marketing-heavy dataset. Nobody has said which system the records actually came from.
• PeopleSoft context: In a September 25, 2026 post, Google Threat Intelligence Group and Mandiant (tracking ShinyHunters as UNC6240) describe renewed mass exploitation of Oracle PeopleSoft CVE-2026-35273. The group got around WAF rules by requesting /%50SEMHUB/ instead of /PSEMHUB/ and deployed web shells on dozens of systems in sectors including healthcare. GTIG does not name Sharecare, and nothing in the sources connects this incident to PeopleSoft. It shows the group has more than one way in, not that it used this one here.

Bottom line: the accounts point to CRM or marketing-platform data theft, but the access method is still unknown.

What Organizations Should Do

1. Assume your staff are in the dataset if you deal with Sharecare. Employers, health plans and providers that buy from or were pitched by Sharecare should check their domains in HIBP's domain search. Warn benefits, HR and procurement teams to expect phishing emails that mention Sharecare by name and look like vendor sales mail.
2. Lock down SaaS connected apps. In Salesforce and similar platforms, restrict who can authorize connected apps and OAuth integrations. Require admin approval for new apps, and review existing authorizations for unfamiliar or recently added apps, especially data-loader and API tools.
3. Harden help desk and employee phone workflows against vishing. Train staff that IT will never phone them to ask them to approve an app or enter a connection code. Require call-back verification for any request that touches SaaS access.
4. Audit Experience Cloud and other public-facing SaaS surfaces. Review guest user profile permissions and sharing rules. Make sure unauthenticated users cannot query CRM objects.
5. Patch PeopleSoft regardless of this incident. If you run Oracle PeopleSoft, apply Oracle's patch for CVE-2026-35273 and disable or remove EMHub/PSEMHUB as Oracle advises. Search WebLogic access logs for /PSEMHUB/ and any percent-encoded variant. GTIG is clear that WAF rules do not replace patching.
6. Monitor for bulk exports. Alert on unusually large report or API exports from CRM and marketing platforms. ShinyHunters' business model depends on getting bulk data out before anyone notices.

Sources: Sharecare Data Breach: 318K Emails From ShinyHunters Leak | ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle Pe... | Sharecare Data Leak Involves 318,000 Records in ShinyHunters | Sharecare, Inc Search the Data Breach | Sharecare data breach: what leaked and what to do — 2-Spyware | Pwned Websites Tyler M-Wise | Beyond the Sharecare Breach: Practical Steps for Singapore Organisa... | Sharecare breach puts 318,000 B2B marketing contacts in the open e...