ShinyHunters Publishes Alleged Sharecare Data Exposing 318,000 Email Addresses

ShinyHunters targeted digital health company Sharecare in an August 2026 “pay or leak” extortion campaign and subsequently published data it claimed came from the company’s systems. Have I Been Pwned lists approximately 318,000 unique email addresses in the exposed dataset, which predominantly contains B2B sales and marketing records. The data also includes records for a small number of Brazilian health insurance plan members, exposing personal details and CPF taxpayer identification numbers.

The Sharecare release appeared alongside reporting that ShinyHunters published alleged Cook Medical and Carhartt data and claimed a breach at Baxter. Those claims do not independently establish compromises at every named company, and the supplied reporting does not establish how Sharecare’s data was obtained. The exposed business contacts create targeted phishing risks, while the Brazilian member records raise identity-fraud concerns. Security teams should assess affected contacts, reinforce phishing defenses, and evaluate notification and identity-protection obligations for exposed plan members.