8fit 8fit.com 8fit data breach: what happened and what to do
In July 2018, fitness app 8fit was breached. Over 15 million email addresses leaked with names, genders, locations, IP addresses and bcrypt password hashes, then appeared for sale in February 2019.
View all 13,115 breaches- Breach date
- Jul 2018
- Affected
- 15,025,407
- Data exposed
- Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In July 2018, the health and fitness service 8fit suffered a data breach. According to Have I Been Pwned, the data appeared for sale on a dark web marketplace in February 2019.
What was exposed
The data covers about 15 million unique email addresses, along with names and genders. Geographic locations and IP addresses leaked too. Passwords were stored as bcrypt hashes, a strong method that makes cracking slow, though a simple password can still fall.
What it means for you
A name, an email address and a rough location make a believable phishing message. Fitness gives scammers easy hooks, such as a renewal or a cancelled plan. The password risk is lower than with older hash types. It isn't zero.
Can the data be taken down?
No. Once a breach is copied and shared, nobody can pull it back, and the company can't either. What you control is how useful the data is to criminals: unique passwords, two-factor login and skepticism toward messages that quote your details. Serus monitors breach databases and the dark web for your email and phone and alerts you when your details appear in a new leak.
What to do
Change reused passwords and turn on two-factor login. Ignore fitness messages that push you to log in through a link.
What to do if you were in it
- 1
Change your 8fit password, and any you reused
If you used the same or a similar password on another account, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey on your email and other important accounts. It blocks most takeovers even when a password is already out.
- 3
Expect phishing that fits the data
Expect emails about subscriptions, plans or refunds that use your name. Go to the app or site yourself instead of clicking.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up again.
Frequently asked
Was I affected by the 8fit breach?
Check your email on Have I Been Pwned or run a free Serus scan. If you had an 8fit account in 2018, assume yes.
What was exposed?
Email addresses, names, genders, geographic locations, IP addresses and bcrypt password hashes.
Should I change my password?
Yes, anywhere you reused it. The hashes are strong, but a short or common password can still be cracked.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
