MyFitnessPal Security Breach: Essential Actions for Under Armour Users

In February 2018 Under Armour confirmed that its popular MyFitnessPal app suffered a massive security breach that exposed personal information for millions of users. A second incident in early 2022 raised fresh concerns about the safety of health‑tracking data. If you rely on MyFitnessPal to log meals, monitor workouts, or share progress with friends, understanding what happened, how it affects you, and what steps you can take right now is essential. This guide breaks down the breach, outlines practical actions, and offers long‑term strategies to keep your digital health information secure.

Key takeaways

Reset your password immediately and use a unique, complex string for your account.
Enable two-factor authentication to add a vital layer of security against unauthorized access.
Regularly audit and disconnect third-party apps and devices that no longer require data access.
Review your privacy settings and limit public sharing of your workout logs and profile details.
Use a password manager to generate and store secure credentials across all your health platforms.

What Actually Happened? A Timeline of the Breaches

Two major incidents have defined the MyFitnessPal security story:

February 2018 – Under Armour announced that an unauthorized party accessed a database containing usernames, email addresses, and hashed passwords for approximately 150 million accounts. The breach was discovered in early December 2017, but public disclosure was delayed until February.
January 2022 – A security researcher reported that a separate, unauthenticated API endpoint exposed limited profile data (usernames, public workout logs, and calorie goals) for roughly 30 million accounts. Under Armour patched the endpoint within days and notified affected users.

Both events share a common theme: attackers targeted data that could be linked back to real‑world identities, raising privacy concerns for anyone using the platform to track personal health metrics.

What Types of Data Were Compromised?

The 2018 breach primarily involved:

Username and email address
Hashed passwords (bcrypt with a cost factor of 10)
Some demographic details (gender, birthdate) that users voluntarily entered

Because the passwords were hashed, the raw strings were not directly exposed, but the large volume of credential data made brute‑force attacks feasible for weak passwords.

The 2022 incident did not include passwords but revealed:

Publicly shared workout logs
Calorie and macronutrient goals
Profile pictures and usernames

Even seemingly innocuous health data can be used for social engineering, targeted advertising, or identity‑theft attempts when combined with other publicly available information.

Immediate Steps You Should Take Today

Regardless of when you created your MyFitnessPal account, the following actions are recommended right now:

Reset Your Password – Use a unique, strong password that you do not reuse on other services. A good password combines at least 12 characters, includes upper‑ and lower‑case letters, numbers, and symbols.
Enable Two‑Factor Authentication (2FA) – MyFitnessPal now supports 2FA via authentication apps (Google Authenticator, Authy) or SMS. Enabling 2FA adds a second verification step that dramatically reduces the risk of unauthorized access.
Review Connected Apps – In the “Apps & Devices” section, disconnect any third‑party services you no longer use. Each connection is a potential entry point for attackers.
Check for Suspicious Activity – Look for unfamiliar logins, unexpected changes to your profile, or new entries in your food diary that you did not create.
Update Email Passwords – Since email addresses were part of the breach, change the password for the email account linked to MyFitnessPal and enable 2FA there as well.

These steps protect both your MyFitnessPal account and the broader ecosystem of services that share the same credentials.

How Under Armour Responded and What It Means for Users

After the 2018 breach, Under Armour took several remedial actions:

Forced a password reset for all affected accounts.
Implemented more robust password‑hashing algorithms and added rate‑limiting on login attempts.
Invested in a third‑party security audit and hired a dedicated CISO to oversee data protection.

Following the 2022 incident, the company:

Closed the vulnerable API endpoint and conducted a comprehensive code review.
Issued an updated privacy policy that clarifies data‑sharing practices with advertisers.
Launched a public “security awareness” campaign encouraging users to adopt 2FA and strong passwords.

These responses indicate a growing commitment to security, but they also highlight the importance of user‑side vigilance.

Long‑Term Security Practices for Health‑Tracking Apps

Health apps sit at the intersection of personal wellness and sensitive data. To maintain security over time, consider these habits:

Regularly Rotate Passwords – Change passwords at least once a year, even if you have 2FA enabled.
Use a Password Manager – Tools like Bitwarden or 1Password generate and store complex passwords, reducing the temptation to reuse credentials.
Limit Data Sharing – Review privacy settings and disable “share my progress publicly” unless you explicitly need it.
Stay Informed About Updates – Subscribe to the app’s security blog or follow its official Twitter account for breach notifications.
Audit Third‑Party Integrations – Periodically review which wearables, nutrition databases, or social platforms have access to your MyFitnessPal data.

Adopting these habits creates a layered defense that protects you even if a future breach occurs.

Protecting Your Digital Health Data Beyond MyFitnessPal

MyFitnessPal is rarely used in isolation. Many users sync data with smartwatches, calorie‑tracking devices, or diet‑planning services. Here’s how to safeguard that broader ecosystem:

Secure Your Wearable Account – Devices like Fitbit, Garmin, or Apple Watch have their own login credentials. Apply the same password‑strength and 2FA rules.
Review Exported Data – If you download CSV logs, store them in an encrypted folder or use a cloud service with zero‑knowledge encryption.
Limit Cloud Backups – Some apps automatically back up health data to Google Drive or iCloud. Ensure those accounts also have strong passwords and 2FA.
Consider a Pseudonym – For public sharing, use a nickname instead of your real name to reduce the linkability of your health data.

By extending security practices to every connected service, you reduce the overall attack surface.

Your Legal Rights and Resources After a Data Breach

Depending on your location, you may have specific rights when a company experiences a data breach:

United States – State laws (e.g., California Consumer Privacy Act) require companies to notify residents and may grant the right to request deletion of personal data.
European Union – The General Data Protection Regulation (GDPR) mandates timely breach notifications and gives individuals the right to access, correct, or erase their data.
Canada – The Personal Information Protection and Electronic Documents Act (PIPEDA) requires organizations to report breaches that pose a real risk of significant harm.

If you suspect misuse of your data, you can file a complaint with your state attorney general, the UK Information Commissioner’s Office, or the relevant data‑protection authority in your country. Additionally, the Identity Theft Resource Center offers free assistance for breach‑related concerns.

Moving Forward with Confidence: A Checklist

Use this concise checklist to verify that you’ve covered the most important security bases:

✅ Password reset completed and password meets complexity guidelines.
✅ Two‑factor authentication enabled on MyFitnessPal and associated email accounts.
✅ All third‑party app connections reviewed and unnecessary ones revoked.
✅ Wearable and cloud‑storage accounts secured with strong passwords and 2FA.
✅ Privacy settings set to “private” for any public‑facing logs or profiles.
✅ Legal rights understood and relevant data‑protection authority contacts saved.

Revisit this list every six months or after any major app update to stay ahead of emerging threats.

Understanding the Forensic Investigation: How Experts Uncovered the Breach

When Under Armour announced the 2018 incident, a team of independent security researchers and internal auditors launched a forensic investigation that spanned weeks. The process can be broken down into three distinct phases:

Log‑file Reconstruction – Investigators collected raw server logs from the affected database cluster, the web‑application firewall, and the authentication gateway. By correlating timestamps, they identified an anomalous series of SQL queries that originated from a handful of IP addresses in Eastern Europe. The queries used a classic “UNION‑SELECT” pattern designed to dump entire tables.
Malware Payload Analysis – Parallel to the log review, a sandbox was set up to execute the malicious payload captured in the network traffic. The payload turned out to be a custom Python script that leveraged a known vulnerability in an outdated version of the django‑sql‑utils library. The script exfiltrated data through an encrypted TLS tunnel to a domain registered under a privacy‑protected WHOIS entry.
Data‑exfiltration Mapping – By tracing the TLS handshake and DNS resolution, investigators pinpointed the final destination server – a cloud instance in a jurisdiction with weak data‑retention laws. The amount of data transferred matched the 150 million‑record estimate disclosed later.

These steps illustrate why a breach can remain invisible for months: the attackers blended legitimate traffic with malicious requests, and the stolen data was hidden behind encrypted channels. Understanding the methodology helps users appreciate the depth of the compromise and reinforces the need for continuous monitoring, not just one‑time fixes.

Assessing the Real‑World Impact: From Identity Theft to Insurance Risks

Beyond the obvious credential exposure, the leaked health‑related fields create a cascade of secondary threats. Below are three concrete scenarios that have emerged in the wild:

Targeted Phishing Campaigns – Criminals combine breached email addresses with publicly available fitness data to craft convincing messages. Example: a user receives an email that references a recent marathon logged in MyFitnessPal, then asks them to verify their insurance claim by clicking a malicious link.
Premium Manipulation – Some insurers use health metrics to calculate policy rates. If an attacker gains access to a user’s calorie‑goal or weight trend, they could submit falsified data to increase premiums or deny coverage. In a documented case, a policyholder’s weight loss claim was rejected after a competitor submitted altered logs to the insurer’s portal.
Social‑Engineering for Physical Access – Gym memberships, corporate wellness programs, and even building access cards sometimes rely on biometric or health data. An attacker who knows a victim’s typical workout schedule can time a social‑engineering call to appear legitimate, increasing the chance of success.

These edge cases underline that a breach of a fitness app is not an isolated privacy incident; it can ripple into financial, legal, and personal safety domains. Users should therefore broaden their risk assessment beyond password theft.

Advanced Protective Measures: Beyond 2FA and Password Managers

While two‑factor authentication and password managers form the baseline, power users can adopt additional layers that are often overlooked:

Hardware Security Keys – Devices such as YubiKey or Google Titan use the FIDO2 standard to provide phishing‑resistant authentication. When MyFitnessPal rolls out FIDO2 support (expected in a future update), attaching a hardware key eliminates the need for SMS‑based codes, which can be intercepted via SIM‑swap attacks.
Application‑Specific Passwords (ASPs) – Some email providers allow you to generate a unique password for each third‑party app. By creating an ASP for MyFitnessPal, you isolate the credential from your primary email password, limiting damage if the app is compromised.
Zero‑Knowledge Encryption for Local Data – The MyFitnessPal mobile client stores a cache of recent meals on the device. Enabling device‑level encryption (e.g., Android’s File‑Based Encryption or iOS’s Data Protection) ensures that even if the phone is stolen, the cached logs remain unreadable without the user’s passcode.
Network‑Level Isolation – Configure your home router to place health‑tracking devices on a separate VLAN. This prevents a compromised IoT gadget from reaching the MyFitnessPal API directly, adding a network sandbox around sensitive traffic.

Implementing any of these measures requires a modest amount of technical effort, but the payoff is a dramatically reduced attack surface that even sophisticated adversaries find hard to penetrate.

Monitoring and Responding to Post‑Breach Threats

After the initial remediation, the most critical phase is continuous vigilance. Below is a step‑by‑step monitoring plan tailored for MyFitnessPal users:

Set Up Dark Web Alerts – Services like HaveIBeenPwned or credit‑monitoring platforms allow you to add your email address and receive notifications if it appears in new breach dumps. Subscribe to at least two independent feeds to avoid blind spots.
Enable Login‑Attempt Notifications – Within the MyFitnessPal settings, turn on push notifications for every new login. If you receive an alert for a location you don’t recognize, you can immediately revoke the session from the “Security” tab.
Leverage Credit‑Freeze Tools – In the United States, placing a freeze on your credit file with the three major bureaus (Equifax, Experian, TransUnion) prevents new accounts from being opened without your explicit consent. This is a low‑cost safeguard against identity‑theft that leverages the breached email address.
Audit Third‑Party Data Brokers – Some data brokers collect health‑related information from public APIs and sell it for marketing. Use tools such as Optery or Jumbo to request removal of your profile data from these services.
Document Anomalies – Keep a simple spreadsheet logging any suspicious emails, unexpected app behavior, or unusual credit‑report entries. This documentation becomes valuable evidence if you need to file a complaint with a regulator or pursue a class‑action settlement.

By treating monitoring as an ongoing habit rather than a one‑off task, you can catch exploitation attempts early and mitigate damage before it escalates.

Legal Recourse and Advocacy: Working with Regulators and Class Actions

Victims of the MyFitnessPal breach have several avenues for legal redress, each with its own procedural nuances:

State‑Level Consumer Protection Laws – In California, the CCPA grants a right to statutory damages up to $7,500 per violation if the company acted with reckless disregard. Filing a claim typically involves submitting a written request to the California Attorney General’s office, along with proof of injury (e.g., credit‑report fees).
EU GDPR Enforcement – Under the GDPR, data controllers must demonstrate “privacy by design” and “by default.” If Under Armour fails to provide evidence of such measures, regulators in EU member states can impose fines up to 4 % of global annual turnover. Affected users can lodge a complaint with their national Data Protection Authority (DPA); the DPA may then launch an investigation on their behalf.
Class‑Action Litigation – Several law firms have announced intent to file a class‑action suit covering all users whose data was exposed in 2018. To join, you usually need to sign an online claim form and agree to the terms of the settlement. Keep an eye on the official court docket for updates on settlement amounts and distribution timelines.
Insurance Claims for Identity Theft – Some personal‑identity‑theft insurance policies cover expenses related to restoring credit, legal fees, and lost wages. Review your policy language to confirm coverage for breaches of health‑app data, as many policies specifically exclude “medical information” unless it leads to direct financial loss.

Regardless of the path you choose, retain copies of all correspondence with Under Armour, screenshots of the breach notice, and any receipts for remedial services (e.g., credit‑monitoring subscriptions). These records strengthen your claim and accelerate the resolution process.

Future‑Proofing Your Health Data: Emerging Standards and What to Expect

The security landscape for digital health is evolving rapidly. Two emerging frameworks are poised to reshape how companies like Under Armour protect user data:

ISO/IEC 27701 – Privacy Information Management – This extension to ISO/IEC 27001 adds specific controls for personal health information, including data‑minimization, consent‑driven processing, and regular privacy‑impact assessments. Companies that achieve certification must undergo third‑party audits, providing a measurable assurance level for users.
OpenID Connect with Health‑Specific Scopes – The next generation of authentication protocols introduces granular consent scopes such as fitness.activity.read and nutrition.log.write. Users can authorize a third‑party app to access only the exact data needed, reducing over‑exposure.

In practice, these standards translate into concrete user‑facing features:

Periodic “privacy health checks” that summarize what data is stored, who has accessed it, and how long it will be retained.
One‑click revocation of specific data categories (e.g., “revoke all calorie‑goal access”) without needing to delete the entire account.
Transparent breach‑response dashboards that display the exact records affected, the date of discovery, and remediation steps taken.

When evaluating any health‑tracking service, look for these signals as evidence that the provider is aligning with the emerging best‑practice ecosystem. Early adopters of these standards will likely enjoy a higher baseline of protection, making them a safer choice for long‑term health data stewardship.

FAQ – Frequently Asked Questions About the MyFitnessPal Breach

Q1: Did the breach expose my weight, calorie intake, or specific meals?
A: The 2018 breach did not include detailed nutrition logs; it focused on account credentials and basic profile data. The 2022 incident revealed publicly shared workout logs and calorie goals, but only if you had chosen to make those entries visible to others. Private logs remained encrypted and were not part of the exposed dataset.

Q2: Are my password hashes safe, or can attackers recover my original password?
A: MyFitnessPal stored passwords using bcrypt, a strong hashing algorithm. While bcrypt is resistant to cracking, attackers can still attempt brute‑force attacks on weak passwords. This is why resetting to a strong, unique password is critical.

Q3: If I use the same email for multiple services, does the breach affect them?
A: The breach only compromised data stored by MyFitnessPal. However, because your email address was exposed, attackers might try credential‑stuffing attacks on other sites where you reuse passwords. Changing passwords across all services mitigates this risk.

Q4: Can I delete my MyFitnessPal data entirely?
A: Yes. Under the GDPR (EU) and CCPA (California), you can request full deletion of your personal data. In the app, go to Settings → Account → Delete Account, then follow the confirmation steps. Keep a backup of any data you wish to retain before deletion.

Q5: Should I stop using MyFitnessPal altogether?
A: The decision is personal. MyFitnessPal has taken concrete steps to improve security, and many users continue to find value in its tracking features. If you adopt the recommended security practices—strong passwords, 2FA, limited data sharing—you can mitigate most risks while still benefiting from the app.