MyFitnessPal data breach: what happened and what to do

MyFitnessPal is a calorie and fitness tracking app. In 2018 it belonged to Under Armour, which announced that account data had been stolen. Have I Been Pwned (HIBP) dates the breach to February 2018 and added it to its database in February 2019.

What happened

Under Armour said the MyFitnessPal team became aware on March 25, 2018 that an unauthorized party had acquired data tied to user accounts in late February 2018. The company announced it on March 29 and estimated about 150 million users were affected. HIBP's copy of the data holds 143,606,147 accounts, and that is the number used on this page.

What was exposed

HIBP lists these data types:

• Email addresses
• Usernames
• IP addresses
• Passwords (as hashes)

Under Armour said most passwords were protected with bcrypt, a hashing method built to be slow to crack. Reporting at the time says the remaining passwords used an older method called SHA-1, which is much easier to crack. The company said payment card data wasn't affected, because it was collected and processed separately.

A hash is a scrambled version of a password. Strong hashes like bcrypt make stolen passwords hard to recover, but short or common passwords can still fall to guessing. Weak hashes like SHA-1 make that guessing fast.

What criminals can do with it

Email addresses and usernames are enough to start targeted phishing. A message that says it's from MyFitnessPal or Under Armour and asks you to "verify" your account is an easy fit for this breach. If a criminal cracks your password, they will try it on your email, your bank and other apps, because many people reuse passwords.

The IP addresses give a rough idea of where you were when you used the app. They don't reveal a home address on their own.

The company's response

Under Armour told users to change their passwords and said it would force a password change for all users. The fitness data itself, such as meals and workouts, isn't listed as exposed.

What this breach is a reminder of

A fitness app isn't where most people expect a serious leak. The practical risk is password reuse: the app account is low value, but the same email and password on a mailbox is not.

Serus can't take breach data off the internet, because it's already in files that have been copied. What it does is monitor breach databases and the dark web for your email and other details, and alert you when they appear. The steps below cover what to do about this one.

How to check your own exposure

Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. If it lists MyFitnessPal, your email and username are in the file. Also search any older email addresses you used for the app, because people often sign up with a throwaway address and forget it.