Jefit jefit.com Jefit data breach: what happened and what to do
Jefit, a workout tracking app, had a breach in August 2020 that exposed 9,052,457 accounts in Have I Been Pwned. Email and IP addresses, usernames and password hashes were exposed, and several million cracked passwords later circulated.
View all 13,115 breaches- Breach date
- 11 Aug 2020
- Affected
- 9,052,457
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Jefit is a workout tracking app. Have I Been Pwned lists 9,052,457 accounts from a breach it dates to August 11, 2020.
What happened
The data was sold within the hacking community and later spread. Jefit published a public announcement in March 2021. It said accounts registered before September 20, 2020 might be affected and that it emailed potentially affected users. Jefit also said no payment data was involved, because payments were handled by Google Play, Apple's App Store or a payment gateway.
What was exposed
Email addresses, IP addresses, usernames and passwords stored as either vBulletin or argon2 hashes. Several million cracked passwords later appeared in broad circulation, so the risk to anyone with a weak password is real.
What that means for you
Your password is the main concern. Cracked passwords are tried against other sites in automated attacks, so a reused password can unlock your email or other accounts. Your email address and username also give scammers a target for phishing that mentions fitness or workouts. A fake "your account has been locked" email that links to a lookalike login page is the most likely form it takes, so type the address yourself instead of clicking.
What to do if you were in it
- 1
Change your Jefit password and anywhere you reused it
The passwords were stored as vBulletin or argon2 hashes, which attackers can crack, especially weak ones. Pick a new, unique password for Jefit and for any other account that shared it. A password manager makes that painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, banking and shopping accounts. A leaked password then isn't enough to log in.
- 3
Expect phishing that mentions Jefit
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention Jefit or your orders with suspicion, and go to the site directly instead of clicking links.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the Jefit breach?
Jefit said accounts registered before September 20, 2020 might be affected. Check your email on Have I Been Pwned, which lists 9,052,457 accounts.
Was my payment information exposed?
Jefit said no payment data was involved, since payments are handled by Google Play, the App Store or a payment gateway.
What was exposed?
Email addresses, IP addresses, usernames and password hashes.
Should I change my password?
Yes, for Jefit and anywhere you reused it. Several million cracked passwords circulated.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
