The Diet.com Data Breach Quietly Exposed 178,922 Accounts

HEROIC analysts identified the Diet.com breach, a dataset tied to the domain diet.com and dated August 1, 2014. The breach affected 178,922 accounts. The password data associated with this breach was stored using MD5 hashing, including the MD5(phpBB3) variant used by phpBB forum software, while a portion of accounts had no password data recorded at all.

The Diet.com Data Breach Quietly Exposed 178,922 Accounts

A breach this size does not need dramatic details to matter. At nearly 179,000 accounts, even a limited exposure gives attackers a large list to work with, and the mix of MD5 and phpBB3-style password hashes suggests this data likely originated from a community or forum feature on the site, a common target for older, unpatched forum software.

What Is Known About the Diet.com Breach

• 178,922 accounts affected
• Passwords hashed with MD5
• Some passwords hashed with the phpBB3 variant of MD5
• A portion of accounts had no password data
• Breach dated August 1, 2014

Why This Matters for Diet.com Users

MD5 hashes, including the phpBB3 variant, are considered weak by modern standards and can often be cracked with widely available tools. If a password from this breach is recovered, the resulting credential stuffing risk extends to any other account where that password was reused, potentially leading to account takeover, identity theft, or financial fraud well beyond the original site.

How a Database Breach Like This Happens

A database breach happens when an attacker gains unauthorized access to the records stored behind a website, often through a software vulnerability, such as an unpatched forum platform, or stolen admin credentials, and copies the data out. Once extracted, this kind of data typically circulates on breach aggregation sites and forums, where older hash formats like MD5 are run through cracking tools long after the original incident.

Check If You Were Affected by the Diet.com Breach

If you ever created an account on diet.com, it is worth checking whether you were part of this breach. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this one, so you can find out in seconds and update any reused passwords.