MyFitnessPal, owned by Under Armour at the time, suffered a data breach in February 2018 when an unauthorized party gained access to user account data. The breach exposed records tied to approximately 150 million users. The attack vector was a misconfiguration, meaning a security flaw in how the system was set up allowed direct access to the data rather than requiring a sophisticated external hack. The stolen data later appeared for sale on a dark web marketplace in 2019 and began circulating more broadly from there. The breach exposed email addresses, usernames, IP addresses, and passwords. Passwords for older accounts were stored using SHA-1 hashing, a weaker method that makes cracking them more feasible. Newer accounts used bcrypt, a stronger standard. Because MyFitnessPal tracks eating habits, exercise routines, and behavioral patterns over time, the exposed data goes beyond basic credentials. Affected users faced a layered risk: account takeover through credential stuffing, targeted phishing using health and lifestyle context, and personal profiling tied to their fitness and nutrition histories. Under Armour disclosed the breach publicly and said MyFitnessPal forced password resets and disabled the compromised passwords. No significant regulatory action was publicly reported following the disclosure. For affected users, the practical risk remains elevated years later. Stolen credentials from this breach have circulated widely, meaning anyone who reused their MyFitnessPal password on other accounts should treat those accounts as potentially compromised.

Health and fitness applications collect user accounts, emails, passwords, and behavioral data related to diet, exercise, and health routines.

MyFitnessPal remains an active standalone consumer health product with a steady release cadence and visible product expansion in 2025 and 2026. Recent official updates highlight new nutrition-tracking features, recipe planning, photo-upload logging, sleep-related features, and GLP-1 support, which shows the platform continuing to deepen its role in day-to-day health management rather than remaining a static legacy app.