Here’s just-a-guess, but I betcha it’s a pretty good guess ...

Your shell-command uses a single greater-than sign ... instead of two.

That is to say, it says shasum $file > data, rather than shasum $file >> data

Therefore, each command is replacing the file named data every time, instead of appending to it, as you probably intend.