MyFitnessPal data breach: what actually happened

MyFitnessPal is the calorie and food-tracking app now owned by Francisco Partners, which acquired it from Under Armour in 2020. Because ownership has changed hands more than once, and because Under Armour, the former owner, had its own major breach in late 2025, search results and news coverage genuinely blur together.

The three events below are distinct. They involve different companies, different systems, different dates and different data. Working out which one a headline is describing is the first step to knowing whether it affects you at all.

Under Armour, which owned MyFitnessPal at the time, disclosed that an unauthorised party had acquired data from roughly 150 million user accounts. The intrusion was detected in late February 2018 and disclosed publicly on 29 March 2018. This remains the largest confirmed MyFitnessPal-related breach.

What was exposed: usernames, email addresses and hashed passwords. No financial data and no precise location data were reported as part of this incident.

This was a separate, later incident affecting Under Armour's own retail systems. By then, Under Armour no longer owned MyFitnessPal, having sold it in 2020. The Everest ransomware group claimed responsibility, and Under Armour confirmed around 72 million customer records were affected after refusing to pay.

Full details are on our Under Armour 2025 breach page. This is the likely source of most “2025” search traffic landing on MyFitnessPal queries.

MyFitnessPal acquired the calorie-tracking app Cal AI in early March 2026. Within days, hackers claimed to have breached Cal AI's own systems, alleging exposure of over 3 million users. The claim is unconfirmed by Cal AI or MyFitnessPal, and reporting indicates only Cal AI's systems were implicated, not MyFitnessPal's core account database.

None of the three incidents has been reported to include full credit card numbers or plaintext passwords.

You may be affected if any of these apply:

• You had a MyFitnessPal account before March 2018, the original breach.
• You were an Under Armour customer, via website, app or in-store loyalty account, before November 2025.
• You used the Cal AI app before March 2026, even if you have since migrated to MyFitnessPal.

If you have used the same email across any of these services, or reused a password, the safest approach is to check your exposure rather than guess.

1. Check your exposure (5 minutes). Run your email through a free breach check to see which of these, if any, actually involves your address. See also what to do if your email is in a data breach.
2. Change your MyFitnessPal password, even if unaffected (2 minutes). If it is old or reused elsewhere, update it now and turn on two-factor authentication if offered.
3. Check for password reuse (10 minutes). If your MyFitnessPal or Under Armour password is used on any other account, such as email, banking or social, change it there too.
4. Watch for phishing referencing fitness or purchase data (ongoing). Scammers use exposed details like purchase history or weight and height data to make phishing emails feel personal and legitimate.
5. Consider a credit ban if your date of birth was exposed (15 minutes). This applies mainly to the Under Armour or Cal AI incidents. Contact Australia's credit reporting bodies, Equifax and Experian, which has now acquired illion, to place a ban on new credit applications in your name.
6. Report anything suspicious (5 minutes). Report phishing attempts to Scamwatch, and call IDCARE on 1800 595 160 if you suspect identity misuse.

In The Event Of is built around turning scattered account records into a single map. You can connect a supported inbox (Gmail or Outlook) so it can scan for account-related metadata, sender addresses, subject lines and timestamps rather than the body of your emails, or add services manually. It then organises what it finds into a digital footprint, highlights breach exposure across known incidents, and gives you guided steps for each account, including old fitness and retail accounts you may have forgotten. You stay in control of every change. If you would rather work through it by hand first, our guide to finding accounts linked to your email covers the manual process.