Jefit Data Breach (2020): What Was Exposed & What To Do

In August 2020, the workout tracking service Jefit experienced a data breach that exposed records belonging to 9.1 million users. The incident was reported on 11 August 2020, after which portions of the data were sold within online forums and several million passwords appeared in circulation after being cracked from their stored hashes. The breach affected email addresses, IP addresses, usernames, and passwords. The passwords were stored as vBulletin or argon2 hashes. Public reporting indicates that the data set later circulated more widely once some hashes were cracked.

Breaking down the breach

Available information states that the breach occurred sometime before the August 2020 reporting date. The compromised records contained email addresses, IP addresses, usernames, and passwords hashed with either vBulletin or argon2 formats. After the initial incident, the data was offered for sale in hacking communities, and several million passwords subsequently appeared in broader circulation once the hashes were cracked.

No further technical details, such as the precise intrusion method or the exact date range of the compromise, have been disclosed in public reporting. The total number of affected individuals is given as 9.1 million.

How a breach like this happens

Incidents involving the exposure of user credentials and contact data often begin with an attacker obtaining access to an application’s database or backup storage. This access can occur through unpatched software, weak authentication controls, or compromised administrative credentials. Once inside, an attacker can copy tables containing account information.

Passwords stored only as hashes can still be attacked offline if the hashing method is outdated or if large numbers of records are available for testing against known password lists. When cracked passwords later circulate, they increase the risk that the same credentials will be tested against other services.

Who is Jefit?

Jefit operates a mobile and web application used for tracking workouts, exercise routines, and fitness progress. Services of this type maintain user accounts to store personal fitness histories, device information, and contact details. A breach at such a service is consequential because the data can be combined with records from other platforms to build more complete profiles of individuals.

What data was at risk

The breach record identifies email addresses, IP addresses, usernames, and passwords as the exposed data types. Passwords were present only in hashed form using vBulletin or argon2 algorithms. No additional categories of information, such as detailed fitness logs or payment details, are named in the reported facts, so their involvement remains unconfirmed.

The real-world impact

Individuals whose email addresses and usernames appeared in the data set face an elevated chance that those details will be used in targeted phishing or credential-stuffing attempts against other online accounts. IP addresses can reveal approximate locations at the time of use. The organisation itself must address remediation, user notifications, and any regulatory obligations that follow the exposure of account data.

Because several million passwords were later cracked and circulated, users who reused those passwords elsewhere carry an ongoing risk until they change credentials on every affected service.

Were you affected?

Users can check whether their email address appears in known breach data sets by running a free exposure scan through a reputable service that aggregates public breach records. If matches are found, the immediate steps are to change passwords on Jefit and any other sites where the same credentials were used, and to enable multi-factor authentication wherever it is available.

AICompiled with AI assistance from public sources and published under our editorial standards.