So I logged into MyFitnessPal this morning to enter my breakfast (two eggs, toast, coffee, the usual) and there's a banner at the top telling me my account may have been compromised. Great. Under Armour, who owns MyFitnessPal now, put out a statement yesterday saying about 150 million accounts got hit sometime back in February. Usernames, email addresses, and hashed passwords. They're being pretty clear that it wasn't Social Security numbers or credit card info, since apparently they keep that stuff on a separate, more locked-down system. Small mercies.
I've been using this app on and off since maybe 2013 to log runs and count calories when Im trying to be good about things, so of course my account was in there. I got the email around 9am, right as I was about to head out the door, and just stood in the kitchen re-reading it twice because I couldn't remember what password I'd used. Turns out it was one I definitely also used somewhere else, because thats what you do when you sign up for a fitness app in 2013 and don't think twice about it. I've since gone in and changed it, and also changed it on the two other places I'm pretty sure I reused it, which took way longer than it should have because I don't actually have all my old accounts written down anywhere sensible.
One thing thats actually kind of interesting here, if youre into this stuff like I am: Under Armour says most of the passwords were hashed with bcrypt, and only "a small subset" used SHA-1. Bcrypt is slow by design, which is the whole point when youre trying to make a stolen password database useless to whoever grabbed it. SHA-1 is fast and was never really meant for password storage in the first place, its more of a general-purpose hash, and its been considered weak for this specific job for years now. So if your account happened to fall into that SHA-1 bucket, its worth assuming whoever has that database can crack it eventually, maybe already has. If your account was newer and bcrypt-hashed, youre in better shape, but I still wouldn't sit around and wait to find out.
This is the fourth or fifth "hey your data got out there" email I've gotten in the last year and a half if I'm counting Equifax, and I'm sure Im not even counting all of them because at some point you stop opening the emails carefully. Which is exactly the problem, right, the more of these happen the less anyone reacts to any individual one. I don't have a tidy fix for that. I use a password manager now for anything that matters, which I probably should've done five years ago, and I still catch myself typing the same lazy password into some random newsletter signup because who cares, its a newsletter. Then six months later that site gets breached too and it turns out I did reuse it somewhere that mattered after all.
Under Armour's stock dropped a bit on the news, which I guess makes sense, 150 million is a big number even by the standards of 2018 breaches. It's not Equifax-big in terms of what was exposed, no financial data, no SSNs, but its big in terms of sheer accounts, and MyFitnessPal is the kind of app where a lot of people probably used their real name and their actual personal email because why would you fake it for a calorie tracker. I don't think anyones diet data is going to ruin their life if it leaks, but the email and password combo absolutely can, especially with password reuse being what it is.
Separately, and I'm not going to get into it much because everyone's already covered it to death this month, but the whole Facebook and Cambridge Analytica situation has had me thinking about this stuff more than usual anyway. It's been one of those weeks where you just start assuming everything you've ever signed up for is compromised somewhere and you're only finding out about it in stages.
Anyway. Go change your MyFitnessPal password if you have one, and if you're the type who's used the same password since 2013 like apparently I still was in at least one place, today's as good a day as any to stop doing that. I'm off to actually eat my eggs before they get cold.