MyFitnessPal data breach (2018)

In February 2018, MyFitnessPal, the diet-and-exercise tracking app owned by apparel maker Under Armour, suffered a breach that exposed roughly 144 million accounts — one of the largest single breaches of that year.

What happened

The intrusion occurred in February 2018, but Under Armour did not become aware of it until 25 March 2018, when it learned that an unauthorized party had acquired data tied to MyFitnessPal user accounts. The company disclosed the breach publicly four days later, on 29 March 2018, initially describing about 150 million accounts as affected. Under Armour's share price dropped on the announcement.

The stolen data later resurfaced in early 2019 as part of a massive tranche of 620 million records from 16 websites offered for sale by GnosticPlayers — the same actor behind the Canva and Dubsmash breaches. Have I Been Pwned ultimately catalogued 143,606,147 unique accounts from the MyFitnessPal set.

What was exposed

The compromised records included usernames, email addresses, IP addresses, and passwords. Importantly, password protection was inconsistent: the majority were hashed with bcrypt, but a portion of older accounts used the weaker SHA-1 algorithm, leaving those credentials more vulnerable to cracking.

Under Armour emphasized what was not taken: the company does not collect government-issued identifiers such as Social Security or driver's license numbers, and payment card data was processed separately and was not affected.

Impact

• Roughly 144 million account records were exposed and later traded on dark-web markets.
• Under Armour required affected users to reset passwords and urged everyone to do so immediately, alongside in-app and email notifications.
• The breach drew scrutiny over the mixed SHA-1/bcrypt hashing — a reminder that legacy accounts often lag behind a company's improved security practices.

Why it matters

MyFitnessPal underscores two recurring lessons. First, detection lag: the breach happened weeks before the company noticed, a common pattern that lengthens exposure. Second, inconsistent password hashing — mixing strong bcrypt with legacy SHA-1 — means an organization is only as protected as its weakest stored credentials. The incident also cemented GnosticPlayers as one of the defining bulk-data brokers of the late-2010s, repackaging breaches like this one into sprawling multi-site dumps that fueled credential-stuffing campaigns across the consumer internet.