MyFitnessPal data breach (2018): what happened
2 min read · Updated October 15, 2026
In March 2018 Under Armour announced that an unauthorised party had accessed data from about 150 million MyFitnessPal accounts. Usernames, email addresses and hashed passwords were affected. Payment card data was said not to be involved. Change reused passwords and be alert to phishing.
What happened
Under Armour, which owned the app at the time, said it noticed the incident in late March 2018 and notified users shortly afterwards. The company asked users to change passwords and review their accounts.
What was exposed
- ✓Usernames and email addresses.
- ✓Passwords hashed with different methods, some stronger than others.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Why health apps matter
Fitness and food logs are personal. Even without sensitive financial data, a leaked address linked to a wellness service can be used for targeted scams that use that context.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Were payment details exposed?+
The company said payment card data was collected separately and was not affected.
Is it still safe to use the app?+
Use a unique password and enable any available extra protection.
How do I check my email?+
Run a free check on the address you used for the app.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.