Sharecare Data Breach: 318K Emails & Phone Numbers Leaked

Overview

In August 2026, digital health company Sharecare became the target of a ShinyHunters “pay or leak” extortion campaign. When the company did not pay, the group published data it claimed was stolen from Sharecare’s systems. That dataset contains 318,185 unique email addresses and has since been added to Have I Been Pwned, which means affected individuals can now verify exposure directly.

The majority of the leaked records are not patient health records but B2B sales and marketing files. According to reporting, they include names, physical addresses, phone numbers, job titles, and employer information. A smaller subset involves Brazilian health insurance plan members and includes dates of birth, genders, marital statuses, and CPF numbers - Brazil’s taxpayer identification numbers.

Sharecare is a well-known digital health platform, which makes this incident notable even though the exposed data skews toward business contacts rather than clinical records. The mix of corporate contact data and a smaller pocket of foreign insurance member data complicates the story: two very different populations were caught in the same leak, and each faces different risks.

What Was Exposed

The exposed fields fall into distinct buckets, and each carries its own consequences:

• Email addresses (318,185 unique): The single most useful credential for phishing, spam, and credential-stuffing attacks.
• Names, physical addresses, and phone numbers: The core building blocks of identity theft and highly targeted social engineering.
• Employers and job titles: Makes business email compromise and impersonation far more convincing.
• Dates of birth, genders, and marital statuses: Commonly used as security-question answers and identity-verification data.
• CPF numbers: Brazilian taxpayer IDs are highly sensitive. Unlike a US Social Security number, a CPF is used across banking, tax, and government services, and exposure can enable fraud and account impersonation.

Why This Breach Matters

A leak of marketing data may sound low-stakes, but the combination here is the problem. When an attacker knows your name, your employer, your title, your phone number, and your address, a phishing email or phone call becomes extremely credible. Add a date of birth and the picture is complete enough to open accounts or pass weak identity checks.

The CPF numbers elevate the severity further. For the Brazilian policyholders affected, this is financial and tax identity data that bad actors can weaponize for fraud, and it may not be replaceable the way a password is.

Account Takeover and Phishing Risks

Because the leaked email addresses are tied to real people at known companies, expect phishing that references your actual job and employer. Attackers may impersonate colleagues, vendors, or HR and reference details that appear in the leak. If any of the exposed emails were reused as passwords elsewhere, credential-stuffing attacks become a serious risk, since reused logins can be tested against other services automatically.

For the Brazilian members, the risk shifts toward financial fraud: tax-related scams, fraudulent account openings, and identity impersonation using the CPF.

What to Do Right Now

1. Check exposure. Visit haveibeenpwned.com/Breach/Sharecare and search your email address to confirm whether your data appears in this leak.
2. Change reused passwords. If your Sharecare email password was reused on any other site, change it immediately and use a password manager to generate unique credentials.
3. Watch for targeted phishing. Be suspicious of any message that already knows your employer, title, or phone number. Verify unexpected requests through a separate, trusted channel.
4. Enable multi-factor authentication. Turn on MFA everywhere it is offered, prioritizing email and financial accounts.
5. Monitor your credit and tax identity (Brazilian members especially). Review bank statements and government tax accounts for unfamiliar activity, and consider placing a fraud alert.
6. Limit what you share. Be cautious about handing out your date of birth, phone number, or address to unverified callers and websites.

Security Insight

This breach is a reminder that “B2B marketing data” is not low-risk data. Companies routinely treat sales and contact databases as routine business assets, but when combined with employer, title, and address fields, they become a ready-made toolkit for spear-phishing. The more instructive failure here is the inclusion of a small set of Brazilian insurance member records inside an otherwise commercial dataset - a sign that sensitive regulated data may be sharing infrastructure with ordinary marketing files, where security controls are often weaker. For health and insurance organizations, the lesson is that data segregation is a security control, not just a compliance checkbox.

Further Reading

• All High Breaches
• Recent Data Breaches