MyFitnessPal Exposed 107 Million Accounts in a 2018 Database Breach

HEROIC analysts identified the MyFitnessPal breach while reviewing a large credential dump circulating across dark web marketplaces in 2019. The breach itself occured in February 2018, when attackers accessed the diet and fitness app's database and walked away with over 107 million user records. The stolen data included email addresses, usernames, IP addresses, and password hashes, making this one of the largest health app breaches ever recorded.

How Stolen Fitness App Credentials Fuel Account Takeover Attacks

Email and password combinations from MyFitnessPal are particularly valuable to attackers because people tend to reuse the same login across many services. Criminals run these credentials through automated tools that try them on banks, email providers, and shopping sites. Even though the passwords were hashed rather than stored as plain text, older SHA-1 hashes are seperate from modern protections and can be cracked with the right tools. A cracked hash hands attackers a working password they can use anywhere.

What Was Exposed in the MyFitnessPal Breach

• Email Address
• Username
• IP Address
• Password Hash

Why 107 Million Exposed Records Creates Lasting Risk for Everyone

When a breach of this size hits the dark web, the effects last for years. Attackers use the data for credential stuffing campaigns that target hundreds of other websites. Your fitness tracking history is one thing, but once someone gains access to your email account using a recycled MyFitnessPal password, they can trigger password resets on your bank, your work accounts, and anywhere else that sends email confirmations. This chain of account takeovers is one of the most common paths to full identity theft and financial fraud.

How Database Breaches Work

A database breach happens when attackers exploit a security weakness to gain access to the system where a company stores user information. In cases like MyFitnessPal, the attacker copies the entire user table from the database, which may contain millions of records. The stolen file is then compressed, moved off the server without detection, and eventually sold or posted in underground forums. Companies often do not discover the breach until the data shows up for sale, sometimes months or even a year later.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against a database of over 400 billion leaked records, including the MyFitnessPal breach. Run a scan at HEROIC to see if your credentials are out there and get clear steps on what to do to protect your accounts.