8fit Breach Exposes 15 M User Accounts and Password Hashes
What Happened — In July 2018 the health‑and‑fitness platform 8fit suffered a data breach. The stolen dataset surfaced on a dark‑web marketplace in February 2019 and contains over 15 million unique email addresses, names, genders, IP addresses and bcrypt‑hashed passwords.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential protection and the need for continuous evidence that password storage meets strong hashing standards.
- It underscores the importance of documented privacy‑control processes (consent, data‑subject request handling) that can be demonstrated to auditors.
- A robust privacy‑control assurance program, such as Verisq’s CookiePLUS capability, helps collect and present the required evidence for GDPR/CCPA‑style readiness.
Who Is Affected — Consumer‑focused health‑and‑fitness SaaS providers and their users worldwide.
Recommended Actions
- Force password resets for all affected accounts and enforce multi‑factor authentication.
- Verify that password hashing uses current best‑practice algorithms (e.g., bcrypt with appropriate cost).
- Review and document privacy‑control procedures (consent capture, DSAR processes) and map them to your audit framework.
- Capture continuous evidence of these controls in a Trust Center to support audit readiness.
Technical Notes — Exfiltrated data includes email, name, gender, IP address and bcrypt password hashes. The breach was first reported to Have I Been Pwned by dehashed.com. No specific vulnerability or attack vector was disclosed.