Breach Disclosure: Jefit

On March 21, 2021, Jefit disclosed a data breach that took place in August 2020. 9 million user accounts were compromised in the breach which included email addresses, usernames, IP addresses, and passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

In March 2021, home workout tracking application, Jefit suffered a data breach due to a security bug in a Jefit system. Threat actors gained access to nearly 9 million records of Jefit user information, including encrypted passwords. Jefit reported that financial data was not included in the data breach, as the company does not store customer payment information. Jefit strongly recommends that all users change their password to a more secure format.

In February 2021, an actor using the alias "N9XDZ" posted a data breach package targeting Jefit on a Russian-speaking cybercriminal marketplace forum. The dataset contains 2.8 million records of de-hashed credentials, specifically email and password pairs, and is circulating in other cybercriminal marketplace forums.

Figure 1: Actor "N9XDZ" posted a link to a Jefit data break package on a cybercriminal marketplace forum