MyFitnessPal Breach Exposes 144 Million User Accounts
What Happened — In February 2018 the diet‑and‑exercise service MyFitnessPal suffered a data breach that exposed 144 million unique email addresses, usernames, IP addresses and password hashes (SHA‑1 for older accounts, bcrypt for newer). The data resurfaced on a dark‑web marketplace in 2019 and has been widely circulated since.
Why It Matters for Trust & Control Assurance
- Highlights the risk of weak credential‑storage practices; continuous control‑assurance programs must verify that password hashing meets current cryptographic standards.
- Demonstrates the need for defensible audit evidence that access‑control policies (e.g., MFA, least‑privilege) are enforced and monitored in real time.
- Provides a concrete example of why organizations should maintain an up‑to‑date inventory of credential‑related controls and evidence for regulatory or third‑party reviews.
Who Is Affected – Consumer‑facing health and fitness applications, broader SaaS platforms handling personal health data.
Recommended Actions
- Audit your password‑hashing algorithms; replace legacy SHA‑1 hashes with strong, adaptive functions such as bcrypt, Argon2, or scrypt.
- Deploy multi‑factor authentication for all user accounts and enforce credential‑reuse detection.
- Implement continuous monitoring of credential‑handling controls and retain evidence for audit readiness.
Technical Notes – The breach involved exposure of email addresses, usernames, IP addresses and password hashes stored as SHA‑1 (legacy) and bcrypt (newer). No specific vulnerability (CVE) was disclosed; the incident appears to stem from inadequate protection of credential data. Source: Have I Been Pwned – MyFitnessPal breach