MyFitnessPal — 144 Million Accounts, and Whether Yours Was Safe Depended on When You Joined (2018)

What happened

In February 2018 the diet and exercise service MyFitnessPal was breached, exposing 143,606,147 unique email addresses alongside usernames and IP addresses. In 2019 the data was listed for sale on a dark-web marketplace among the GnosticPlayers batches and subsequently circulated widely.

Two different breaches wearing one name

The password storage is the unusual part and it is genuinely important. MyFitnessPal stored passwords as SHA-1 for earlier accounts and bcrypt for newer ones. The company had migrated its hashing at some point, and the breach caught it mid-transition.

The practical consequence is that this single breach has two completely different risk profiles. If your account predates the migration, your password was protected by a fast hash and should be considered recoverable. If it postdates it, bcrypt almost certainly held.

And here is the part no advice column will tell you: you have no way to find out which group you are in. The migration date was never published, your signup date is not something most people remember, and the dataset does not annotate it. The only safe assumption is the pessimistic one — that yours was SHA-1.

This is exactly the failure mode of a generated breach page that reads DataClasses: Passwords and prints one sentence. The catalogue field is identical for MyFitnessPal and for Wattpad. The correct advice is not.

What a fitness account reveals

The breach itself did not expose weight logs, food diaries or workout history — the exposed classes are email addresses, usernames, IP addresses and passwords. It is worth being precise about that, because inflated claims about health data circulate around this incident.

What the dataset does establish is membership: confirmation that a given person used a weight-management service. That inference alone has been enough to fuel targeted advertising and, in some documented patterns, extortion-flavoured phishing. IP addresses add rough location at the time of use.

The identity-chain implication

Health and fitness accounts are almost always registered with a person's primary personal email address, not a throwaway. People compartmentalise gaming and shopping; they rarely compartmentalise the app they weigh in on.

That makes a fitness-service dataset a high-confidence map from a real, actively used address to a real person — which is precisely the anchor an attacker needs before spending effort on anything else. Under Armour owned MyFitnessPal at the time, and the corporate parent has its own separate entry in the catalogue; the two are distinct incidents and should not be conflated.

What to do now