MyFitnessPal Data Breach (2018): What Was Exposed & What To Do

In February 2018, MyFitnessPal reported a data breach that affected 143.6 million user accounts. The incident exposed email addresses, usernames, IP addresses, and passwords stored as cryptographic hashes. The data later appeared on a dark web marketplace in 2019 and began circulating more widely. The scale of the incident means that a large portion of the service’s user base may have had account credentials and contact information placed outside the company’s control. Individuals who created accounts with the same email and password combinations used elsewhere face the possibility that those credentials could be tested against other services.

Inside the incident

The breach was publicly reported on 1 February 2018. Company statements at the time indicated that usernames, email addresses, IP addresses, and passwords hashed with SHA-1 for older accounts and bcrypt for newer accounts had been accessed. No further technical details about the intrusion method or the precise volume of records were released in the initial disclosure. In 2019 the same data set was listed for sale on a dark web marketplace alongside other large breach collections and subsequently appeared in broader circulation.

How a breach like this happens

Incidents involving bulk extraction of user account data often begin with an attacker obtaining access to an application server or database through a remote vulnerability, stolen administrative credentials, or misconfigured storage. Once inside, the attacker can copy tables containing user records. Passwords are frequently stored as hashes rather than plain text, yet the hashes themselves remain useful to attackers who can attempt offline cracking or reuse them in credential-stuffing attacks against other sites. The time between initial access and public discovery can range from weeks to years, and the data may change hands multiple times before appearing on marketplaces.

MyFitnessPal and its sector

MyFitnessPal operates a diet and exercise tracking platform that requires users to create accounts to log meals, workouts, and personal metrics. Services in this sector routinely collect email addresses for account management, IP addresses for security logging, and passwords for authentication. Because users often reuse credentials across multiple platforms, a compromise at one fitness application can supply attackers with material that is tested against email providers, banks, and workplace systems.

What was likely exposed

The reported data types are limited to four categories. Exact contents of the data set remain unconfirmed beyond the initial disclosure.

• Email addresses
• Usernames
• IP addresses
• Passwords stored as SHA-1 and bcrypt hashes

Why it matters

Email addresses combined with usernames allow attackers to map individuals across services and to craft targeted phishing messages. Hashed passwords can be subjected to cracking attempts, particularly the SHA-1 hashes associated with older accounts. IP addresses may reveal approximate locations at the time of account creation or last login. For the organisation, the incident created operational costs for notification, password resets, and security improvements, while also exposing the limits of its prior password-storage practices.

If your data was in this breach

Change the password on any MyFitnessPal account and on any other service where the same password was used. Enable multi-factor authentication wherever available. Review recent account activity for signs of unauthorised access. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other publicly documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.