8Fit Data Breach Exposes 16.4M Fitness App User Personal Profile Records

HEROIC's DarkHive system discovered the 8Fit breach, exposing 16,458,360 records in July 2018. This German fitness and nutrition app suffered a database compromise that revealed user email addresses, IP addresses, first and last names, and gender information belonging to over 16 million fitness app users worldwide, without exposing any password data.

Why This Is Dangerous

Health and fitness app breaches that expose personal profile data combined with gender information create highly targeted datasets for identity fraud, social engineering, and discriminatory targeting operations. With over 16 million records, this breach represents one of the larger fitness platform exposures and provides attackers with a rich database of health-conscious consumers whose demographic profiles are valuable for commercial fraud and targeted phishing. The combination of full name, email, and gender enables personalized social engineering attacks that appear legitimately tailored to the individual.

What Was Exposed

• Email Address
• IP Address
• First Name
• Last Name
• Gender

Why This Matters

8Fit users whose data was exposed face phishing attacks crafted using their personal details to impersonate health services, subscription renewals, and wellness brands with a high degree of convincing personalization. Health and fitness app user databases are commercially valuable for unauthorized marketing operations that target users with fraudulent health products and services. While no passwords were exposed, the identity data enables account takeover attempts through password reset flows using confirmed email addresses and personal information.

How Database Breach Works

Health and fitness apps collect personal profile information during onboarding to personalize workout and nutrition plans, building detailed demographic databases of their user base. Attackers exploit API vulnerabilities and inadequate access controls in mobile app backends to extract user profile databases without necessarily accessing authentication systems. The resulting personal data records are sold to both criminal actors for fraud operations and unscrupulous data brokers who monetize consumer health and wellness data without consent.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the 8Fit breach. Visit heroic.com to check if your information was exposed.