Breach Disclosure: 8fit

In February 2019, the Register reported that 8fit, a customized fitness and nutrition planning app, was breached in an incident confirmed by 8fit that occurred in July 2018. The breach contained 15M unique email addresses and bcrypt passwords, with some records including names, genders, IP addresses, and expired Facebook tokens. 8fit is yet another one of the 16 organizations publicly identified, with others possibly disclosed soon.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX, recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

8fit is number 6 out of the 16 breaches from The Register report that have been disclosed to the public. The 1.9 GB data dump of email addresses, bcrypted-hashed passwords, countries, country codes, Facebook authentication tokens, Facebook profile pictures, names, genders, and IP addresses was for sale for $728 on the dark web. The German-based 8fit have released a statement and notified all their users with details of the incident and steps to reset their passwords.