MyFitnessPal Data Breach Impacts 150 Million User Accounts

[MacRumors]

MyFitnessPal parent company Under Armour today announced that MyFitnessPal has been the victim of a hacking incident, which has seen personal details of approximately 150 million user accounts accessed in a data breach.

MyFitnessPal is a popular health and fitness iOS app and website that's used by many iPhone and iPad owners, and it is consistently among the top Health and Fitness apps in the App Store.

The breach, which happened in late February, included usernames, emails, and encrypted passwords. Credit card numbers from paying customers were not accessed.

Under Armor has already been sending emails and in-app messages to its customers who were affected by the breach. The company says it is working with "leading data security firms" to assist in its investigation.

MyFitnessPal users will be required to change their passwords.

Article Link: MyFitnessPal Data Breach Impacts 150 Million User Accounts

 

[ck2875]

The breach, which happened in late February, included usernames, emails, and encrypted passwords. Social security numbers, driver license numbers, and credit/debit card information were not accessed.

Serious question: Why the F does MyFitnessPal need someone's SSN or Driver's License number? ...Isn't the point to track your food intake and weight?

 

[pdaholic]

Oh no...now the world will know that I ate cheesecake for dinner last night.

 

[Hustler1337]

What are they doing holding customers' social security and driver license numbers?

 

[Elektrofone]

That's not good news. I don't really have any important info on there but doesn't make me feel good about using the service. Anyone have alternatives?

 

[thisisnotmyname]

Serious question: Why the F does MyFitnessPal need someone's SSN or Driver's License number? ...Isn't the point to track your food intake and weight?

What are they doing holding customers' social security and driver license numbers?

My thought is that they don't but were just clarifying since this will be national news that nothing of that sort was obtained by hackers.

 

[manilaraf]

Social security numbers, driver license numbers, and credit/debit card information were not accessed.

Article Link: MyFitnessPal Data Breach Impacts 150 Million User Accounts

Uh, whoever wrote this article needs to quote from the actual MFP/UA release:

"The affected data did not include government-issued identifiers (such as Social Security numbers and driver's license numbers) because we don't collect that information from users. Payment card data was not affected because it is collected and processed separately."

FAQ #3: https://content.myfitnesspal.com/security-information/FAQ.html

 

[ck2875]

That's not good news. I don't really have any important info on there but doesn't make me feel good about using the service. Anyone have alternatives?

LoseIt.

Way better food database and UI without the social crap MFP tries to cram down your throat. It is also cheaper than MFP for the premium... I think it's like $40/year versus $50/year for MFP. They tend to have offers for discounted premium at $30/year on Black Friday, so I had previously locked in at that rate (though recently I got a special offer for a lifetime subscription to LoseIt for $100 so jumped on that since I had been paying for premium for about 5 years already).

 

[AppleMad98004]

What are they doing holding customers' social security and driver license numbers?

Data triangulation. I know if at least one supermarket chain that does the same for rewards cards. Links bank information and DOL data even if you give fake info because it throws it out when you use a CC/Debt card for the first time with the reward card and replaces it with this real data associated to the actual person.

 

[manilaraf]

Social security numbers, driver license numbers, and credit/debit card information were not accessed.

Article Link: MyFitnessPal Data Breach Impacts 150 Million User Accounts

The British Crown Jewels, the Mona Lisa, and the US Declaration of Independence were also left alone...

 

[coolfactor]

Uh, whoever wrote this article needs to quote from the actual MFP/UA release:

"The affected data did not include government-issued identifiers (such as Social Security numbers and driver's license numbers) because we don't collect that information from users. Payment card data was not affected because it is collected and processed separately."

FAQ #3: https://content.myfitnesspal.com/security-information/FAQ.html

Yup, pooooooor writing indeed! Look how many comments right away showed that what was written was misleading.

 

[Mobster1983]

Curious if this affected this one app, or UA's other fitness related apps like Map My Run. No info in the article but I imagine these are part of the same system.

 

[OldSchoolMacGuy]

Serious question: Why the F does MyFitnessPal need someone's SSN or Driver's License number? ...Isn't the point to track your food intake and weight?

The article is poorly written. Those are just some examples of the type of secure personal information that wasn't leaked. What they're trying to say is that credit card information of paying users wasn't leaked.
[doublepost=1522361471][/doublepost]

Curious if this affected this one app, or UA's other fitness related apps like Map My Run. No info in the article but I imagine these are part of the same system.

It's all part of the same database. I just went and changed my MapMyRide password. Also disconnected Facebook from it.

 

[NoBoMac]

Curious if this affected this one app, or UA's other fitness related apps like Map My Run. No info in the article but I imagine these are part of the same system.

To be safe, I changed the password on both MFP and MapMyWalk (not that it mattered in that no CC on file, using a "burner" email address, and both accounts had different and random passwords).

Might be same systems, but at a high level, does not appear to be tightly tied in that I had to create a different account for MMW and then provide those credentials in MFP app to get sync to work from MMW to MFP.

LoseIt.

Way better food database and UI without the social crap MFP tries to cram down your throat.

Thanks for that. Giving it a whirl. Don't need the premium features. Database, so far, seems to be comparable to what MFP has. UI, to me, seems to be a bit more cluttered, but might get used to it.

 

[JohnDoe98]

No problem MyFitnessPal, I deleted my account.

 

[Starship67]

Damn now some random hacker knows I had Taco Bell for lunch.

 

[69Mustang]

Data triangulation. I know if at least one supermarket chain that does the same for rewards cards. Links bank information and DOL data even if you give fake info because it throws it out when you use a CC/Debt card for the first time with the reward card and replaces it with this real data associated to the actual person.

Thankfully that isn't the case here. They don't even collect that information. The article was just written poorly.

 

[macsba]

I use MyFitnessPal and they don't have my CC#, DL#, and SSN. They've never asked for it. Just to be safe though, I changed my password.

 

[iapplelove]

After equifax, who cares about breaches.

 

[Scottsoapbox]

Why in God's name would a fitness app need your social security number?!?

 

[kildraik]

That sucks.

My fitness pal is my body, and that seems to be working just fine by telling me what I need to know.

 

[chucker23n1]

Why in God's name would a fitness app need your social security number?!?

They don't, nor does MyFitnessPal said they did.

 

[Jovian9]

Uh, whoever wrote this article needs to quote from the actual MFP/UA release:

"The affected data did not include government-issued identifiers (such as Social Security numbers and driver's license numbers) because we don't collect that information from users. Payment card data was not affected because it is collected and processed separately."

FAQ #3: https://content.myfitnesspal.com/security-information/FAQ.html

Terribly written article from MR. Misleading to get clicks.

 

[Starship67]

Why in God's name would a fitness app need your social security number?!?

They don't and have never asked for it. Had you bothered to read the numerous comments above yours before posting you would've known this.

 

[roar08]

Uh, whoever wrote this article needs to quote from the actual MFP/UA release:

"The affected data did not include government-issued identifiers (such as Social Security numbers and driver's license numbers) because we don't collect that information from users. Payment card data was not affected because it is collected and processed separately."

FAQ #3: https://content.myfitnesspal.com/security-information/FAQ.html

The author has a very poor writing style. Not just in this article, but numerous others.