This article is more than 1 year old

This article is more than 1 year old

Personal details of about 150 million users of the MyFitnessPal app were compromised in one of the biggest hacks in history, its owner has confirmed.

US sportswear brand Under Armour said user names, email addresses and scrambled passwords were among the stolen data. However, payment card data was not affected. It urged customers to change their passwords immediately.

The company said on Thursday that the accounts were compromised in February, sending shares of the company down 3% in after-hours trade. The breach was not discovered until 25 March and users were informed four days later.

Under Armour said: “We do not know the identity of the unauthorised party. Our investigation into this matter is ongoing.”

The app allows customers to monitor their calorie intake and measure it against the amount of exercise they are doing using a database of more than 2 million foods. It was founded in 2005 by brothers Mike and Albert Lee.

The data breach is the largest this year and one of the top five to date, based on the number of records compromised, according to SecurityScorecard, a risk management consultancy.

Larger hacks included 3bn Yahoo accounts compromised in 2013 and credentials for more than 412 million users of adult websites run by California-based FriendFinder Networks Inc in 2016.

Under Armour said it was working with data security firms and law enforcement, but did not provide details on how the hackers got into its network or pulled out the data without getting caught.

While the breach did not include financial data, large caches of stolen email addresses can be valuable to cybercriminals.

Email addresses retrieved in a 2014 attack that compromised data on some 83 million JPMorgan Chase customers was later used in “pump-and-dump” schemes to boost stock prices, according to US federal indictments in the case in 2015.

Under Armour bought MyFitnessPal in 2015 for $475m (£338m). It is part of the company’s connected fitness division, whose revenue last year accounted for 1.8% of Under Armour’s $5bn in total sales.



</s>According to American sportswear giant Under Armour, user data from its health app MyFitnessPal has been compromised. Data including the usernames, email addresses, and scrambled passwords from approximately 150 million accounts was stolen last month in one of the biggest attacks of its kind.

Other information such as social security numbers, driving license numbers, and details from payment cards were thankfully not affected, but email addresses and passwords alone have the potential to cause harm in the wrong hands. Under Armour hasn't commented on how the hack was carried out but says it's currently cooperating with the police and data security firms.

Shares dropped 3% as the company released a statement to investors informing them of the breach and assuring them necessary steps were being taken to tighten security. A notice to users was also issued, along with an FAQ page designed to separate fact from fiction and ease some fears.

Users have been urged to change their passwords on other accounts where the same passphrase and username/email address combination has been used as on MyFitnessPal. It's also a time to be overly cautious of any emails asking for personal data or sharing links or attachments. In other words, be very vigilant for the foreseeable future.</s>The Baltimore, Maryland-based athletic company Under Armour announced its MyFitnessPal exercise app was involved in a massive information breach, with upwards of 150 million user accounts potentially affected. Of the hacked data, the brand says only usernames, email addresses, and hashed password information was breached, so it appears (at this time) that no financial information was compromised — which could be seen as somewhat of a silver lining considering how prevalent hacks and breaches have become.

An Under Armour-affiliated application since 2015, MyFitnessPal is a diet and exercise program designed to not just track daily activity but also to motivate its users. The app had around 80 million users prior to its acquisition, but Under Armour’s already-established network of brand loyalists and gear supporters allowed it to grow to more than 165 million users.

Under Armour reports that it was alerted to the breach on March 25 — and that it occurred in February. Upon learning of its severity, the brand “quickly took steps to determine the nature and scope of the issue.” This includes notifying law enforcement, working with data firms to assist in the investigation, alerting its user base and asking for password changes, and monitoring any suspicious behavior. The brand said it strongly recommends any MyFitnessPal user to immediately change their password as a precautionary measure, even if they aren’t necessarily involved in the breach.

“Four days after learning of the issue, the company began notifying the MyFitnessPal community via email and through in-app messaging. The notice contains recommendations for MyFitnessPal users regarding account security steps they can take to help protect their information,” said Under Armour in a statement. “The company will be requiring MyFitnessPal users to change their passwords and is urging users to do so immediately.”

The statement goes on to recommend users be aware of any solicitation for them to provide personal information and to avoid, at all costs, clicking on any links or attachments in suspicious emails. Under Armour also provided additional information about how to change a password and how to better safeguard user information, as well as a list of frequently asked questions surrounding the breach.</s>Personal data from 150 million users of the MyFitnessPal dieting app has been compromised in one of the biggest hacks in history.

According to US sportswear brand Under Armour, which owns the app, the stolen data includes user names, email addresses and scrambled passwords. However, payment cards were not affected.

Users have been urged to change their passwords immediately, including those for other accounts where similar information was used on MyFitnessPal.

Maryland-based company Under Armour said in a statement that it first became aware of the security breach - which occurred in late February this year - on March 25 and began to inform users four days later.

The firm is now working with data security firms and law enforcement agencies to investigate the breach.

“We do not know the identity of the unauthorised party. Our investigation into this matter is ongoing,” a spokesperson said, adding that the company was bolstering systems that detect and prevent unauthorised access to user information.

The MyFitnessPal app allows customers to monitor their calorie intake and measure it against the amount of exercise they are doing using a database of more than two million foods. It was founded in 2005 by brothers Mike and Albert Lee before being bought by Under Armour in 2015.

Risk management consultancy SecurityScorecard told Reuters the data breach is the largest this year and one of the top five to date, based on the number of records stolen.

Larger hacks include 3 billion Yahoo accounts compromised in a 2013 incident and credentials for more than 412 million users of adult websites run by California-based FriendFinder Networks Inc in 2016, according to breach notification website LeakedSource.com.</s>Athletic apparel brand Under Armour announced that a data breach exposed details of over 150 million MyFitnessPal users. The leaked data includes usernames, email addresses, and hashed passwords, but government-issued identifiers like social security numbers and driving licenses were not compromised as the app doesn't collect that information. Similarly, credit card numbers were not leaked.

MyFitnessPal first detected the intrusion — believed to have occurred sometime in late February — on March 25, following which it started coordinating with law enforcement authorities and data security firms to understand the scope of the attack.</s>MyFitnessPal parent company Under Armour has revealed that a massive data breach occurred in February of this year that saw the details of 150 million MyFitnessPal users stolen. The massively popular health and fitness app for Android and iOS devices stores exercise data from users. However, Under Armour says it’s not a user’s exercise data that was stolen, but information including usernames, email addresses, and hashed passwords. At this time, Under Armour does not believe social security or credit card numbers were accessed. For the time being, MyFitnessPal users are being urged to change their passwords for their MyFitnessPal accounts as well as any other accounts that use the same email address and password combo for login details.MG</s>(Reuters) - Under Armour Inc <UAA.N> <UA.N> said on Thursday that data from some 150 million MyFitnessPal diet and fitness app accounts was compromised in February, in one of the biggest hacks in history, sending shares of the athletic apparel maker down 3 percent in after-hours trade.

The stolen data includes account user names, email addresses and scrambled passwords for the popular MyFitnessPal mobile app and website, Under Armour said in a statement. Social Security numbers, driver license numbers and payment card data were not compromised, it said.

It is the largest data breach this year and one of the top five to date, based on the number of records compromised, according to SecurityScorecard.

Larger hacks include 3 billion Yahoo accounts compromised in a 2013 incident and credentials for more than 412 million users of adult websites run by California-based FriendFinder Networks Inc in 2016, according to breach notification website LeakedSource.com.

Under Armour said it is working with data security firms and law enforcement, but did not provide details on how the hackers got into its network or pulled out the data without getting caught in the act.

While the breach did not include financial data, large troves of stolen email addresses can be valuable to cyber criminals.

Email addresses retrieved in a 2014 attack that compromised data on some 83 million JPMorgan Chase customers was later used in pump-and-dump schemes to boost stock prices, according to U.S. federal indictments in the case in 2015.

Under Armor said in an alert on its website that it will require MyFitnessPal users to change their passwords, and it urged users to do so immediately.

"We continue to monitor for suspicious activity and to coordinate with law enforcement authorities," the company said, adding that it was bolstering systems that detect and prevent unauthorized access to user information.

Under Armour said it started notifying users of the breach on Thursday, four days after it first learned of the incident.

Under Armour bought MyFitnessPal in 2015 for $475 million. It is part of the company's connected fitness division, whose revenue last year accounted for 1.8 percent of Under Armour's $5 billion in total sales.</s>Fitness brand Under Armour said personal details of around 150 million users of its MyFitnessPal nutrition app and website were accessed in a breach earlier this year.

The US company said it discovered the breach last Sunday, with data stolen including passwords, usernames and email addresses.

The breach had occurred in late February, and Under Amour has been taking steps to alert users about the incident, it said.

Payment details, driving licences and social security numbers were not accessed by the unauthorised party, as these details are "collected and processed separately", it added.

The MyFitnessPal app and website, which allows people to track their calorie intake and exercise routines,...</s>(Reuters) - Under Armour Inc (UAA.N) (UA.N) said on Thursday that data from some 150 million MyFitnessPal diet and fitness app accounts was compromised in February, sending shares of the athletic apparel maker down 3 percent in after-hours trade.

The stolen data includes account user names, email addresses and scrambled passwords for the popular MyFitnessPal mobile app and website, Under Armour said in a statement. Social Security numbers, driver license numbers and payment card data were not compromised, it said.

It is the largest data breach this year, based on the number of records compromised and likely to go down as one of the 10 largest to date, according to Alex Heid, chief research officer with SecurityScorecard, which evaluates security risks of companies.

Under Armour said it is working with data security firms and law enforcement, but did not disclose whether its network had been hacked or how the information had been removed from its computer systems.

Company representatives could not be reached to elaborate.

While the breach did not include financial data, large troves of stolen email addresses can be valuable to cyber criminals.

Email addresses retrieved in a 2014 attack that compromised data on some 83 million JPMorgan Chase customers was later used in pump-and-dump schemes to boost stock prices, according to U.S. federal indictments in the case in 2015.

Under Armor said in an alert on its website that it will require MyFitnessPal users to change their passwords, and it urged users to do so immediately.

“We continue to monitor for suspicious activity and to coordinate with law enforcement authorities,” the company said, adding that it was bolstering systems that detect and prevent unauthorized access to user information.

Under Armour said it started notifying users of the breach on Thursday, four days after it first learned of the incident.

Under Armour bought MyFitnessPal in 2015 for $475 million. It is part of the company’s connected fitness division, whose revenue last year accounted for 1.8 percent of Under Armour’s $5 billion in total sales.</s>Sports gear maker Under Armour revealed Thursday that its fitness application was hacked in late February, allowing an unauthorized party to access millions of users' information.

This includes usernames, email addresses, and 'hashed' passwords, which make it harder for a hacker to ascertain.

The Baltimore, Maryland-based company said it had contacted law enforcement and outside consultants after learning of the breach.

Under Armour said it learned on March 25 that its MyFitnessPal application was hacked last month.

The app enables users to track activity and calorie intake using a smartphone.

According to the firm, the hack did not affect social security numbers, drivers licenses or credit card data, according to the company.

So far, the company does not know who is behind the hack, but says it is working with ‘leading data security firms’ to investigate the matter.

'The company's investigation is ongoing, but indicates that approximately 150 million user accounts were affected by this issue,' a statement said.

Users were being notified by email and messaging to update settings to protect account information.

In addition, users will be required to change their passwords, which the firm is urging they do immediately.
U.S. sportswear brand Under Armour states that the personal details (including user names, email addresses and scrambled passwords) of about 150 million users of the MyFitnessPal application were compromised in one of the biggest hacks in history.