Under Armour Suffers Massive Security Hacking

Under Armour, Inc. Logo. (PRNewsFoto/Under Armour, Inc.)
Reading Time: 5 minutes

Breaking news from Under Armour.  The company just released the following statement:

Under Armour, Inc. today announced that it is notifying users of MyFitnessPal – the company’s food and nutrition application and website – about a data security issue. On March 25, the MyFitnessPal team became aware that an unauthorized party acquired data associated with MyFitnessPal user accounts in late February 2018. The company quickly took steps to determine the nature and scope of the issue and to alert the MyFitnessPal community of the incident.

Under Armour, Inc. Logo. (PRNewsFoto/Under Armour, Inc.)

Under Armour is working with leading data security firms to assist in its investigation, and also coordinating with law enforcement authorities. The investigation indicates that the affected information included usernames, email addresses, and hashed passwords – the majority with the hashing function called bcrypt used to secure passwords.

The affected data did not include government-issued identifiers (such as Social Security numbers and driver’s license numbers), which the company does not collect from users. Payment card data was also not affected because it is collected and processed separately. The company’s investigation is ongoing, but indicates that approximately 150 million user accounts were affected by this issue.

Four days after learning of the issue, the company began notifying the MyFitnessPal community via email and through in-app messaging. The notice contains recommendations for MyFitnessPal users regarding account security steps they can take to help protect their information. The company will be requiring MyFitnessPal users to change their passwords and is urging users to do so immediately.

In addition, Under Armour provided further information:

MyFitnessPal Account Security Issue: Frequently Asked Questions

1. What happened?

On March 25, 2018, we became aware that during February of this year an unauthorized party acquired data associated with MyFitnessPal user accounts.

2. What did MyFitnessPal do when it discovered the issue?

Once we became aware, we quickly took steps to determine the nature and scope of the issue. We are working with leading data security firms to assist in our investigation. We have also notified and are coordinating with law enforcement authorities.

We are taking steps to protect our community, including the following:

  • We are notifying MyFitnessPal users to provide information on how they can protect their data.
  • We will be requiring MyFitnessPal users to change their passwords and urge users to do so immediately.
  • We continue to monitor for suspicious activity and to coordinate with law enforcement authorities.
  • We continue to make enhancements to our systems to detect and prevent unauthorized access to user information.

3. What information was affected by this issue?

The affected information included usernames, email addresses, and hashed passwords – the majority with the hashing function called bcrypt used to secure passwords.

The affected data did not include government-issued identifiers (such as Social Security numbers and driver’s license numbers) because we don’t collect that information from users. Payment card data was not affected because it is collected and processed separately.

4. What is a “hashed password”?

Hashing is a one-way mathematical function that converts an original string of data into a seemingly random string of characters.

5. What is “bcrypt”?

Bcrypt is a password hashing mechanism that incorporates security features, including multiple rounds of computation, to provide advanced protection against password cracking.

6. What hashing function was used to protect the MyFitnessPal account information that was not protected by bcrypt?

The MyFitnessPal account information that was not protected using bcrypt was protected with SHA-1, a 160-bit hashing function.

7. When did MyFitnessPal become aware of the issue?

On March 25, 2018, we became aware that during February of this year an unauthorized party acquired data associated with MyFitnessPal user accounts.

8. Do you know who did this?

We do not know the identity of the unauthorized party. Our investigation into this matter is ongoing.

9. Who is being notified?

We are notifying MyFitnessPal users to provide information on how they can protect their data.

10. What is the company doing to protect my MyFitnessPal account?

Once we became aware, we quickly took steps to determine the nature and scope of the issue. We are working with leading data security firms to assist in our investigation. We have also notified and are coordinating with law enforcement authorities.

We are taking steps to protect our community, including the following:

  • We are notifying MyFitnessPal users to provide information on how they can protect their data.
  • We will be requiring MyFitnessPal users to change their passwords and urge users to do so immediately.
  • We continue to monitor for suspicious activity and to coordinate with law enforcement authorities.
  • We continue to make enhancements to our systems to detect and prevent unauthorized access to user information.

11. I think I received an email about this issue. How do I know it is really from MyFitnessPal?

Click here to view the content of our email notice to MyFitnessPal users. Please note that the email from MyFitnessPal about this issue does not ask you to click on any links or contain attachments and does not request your personal data. If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by MyFitnessPal and may be an attempt to steal your personal data. Avoid clicking on links or downloading attachments from such suspicious emails.

12. I think I received a message about this issue in the MyFitnessPal app. What should I do?

The in-app message from MyFitnessPal contains a link to our notice to MyFitnessPal users about this issue. Click here to view the content of our in-app notice to MyFitnessPal users.

13. What should I do to help protect my information?

We take our obligation to safeguard your personal data very seriously and are alerting you about this issue so you can take steps to help protect your information. We recommend you:

  • Change your password for any other account on which you used the same or similar information used for your MyFitnessPal account.
  • Review your accounts for suspicious activity.
  • Be cautious of any unsolicited communications that ask for your personal data or refer you to a web page asking for personal data.
  • Avoid clicking on links or downloading attachments from suspicious emails.

14. How do I change my password?

You can change your password by logging into our full site at http://www.myfitnesspal.com. Mobile app users should log in using the same username and password they use in the app.

Once you’ve logged in, click the “My Home” tab, then “Settings,” then “Change Password.”

If you’ve forgotten your password, you can request a password reset email by clicking the “Forgot password or username” link on the sign-in screen of our apps, or by visiting this link in a web browser.

Mobile app users who have not yet verified their email address may receive an error when attempting to reset their password using the “Forgot password?” option on the app’s login screen. These users can visiting this link and enter their email address or username to prompt an email verification request, after which the password request can be made successfully.

15. Will changing my MyFitnessPal password also update my MapMyFitness password?

Changing your MyFitnessPal password will update the password you use for our family of apps.

16. How can I get help with my MyFitnessPal account?

For help with your MyFitnessPal account, please visit our customer portal.

Share This:

About kevin 1562 Articles
No articles on this site should be construed as the opinion of PriceofBusiness.com. Do your homework, get expert advice before following the advice on this or any other site.

Be the first to comment

Leave a Reply

Your email address will not be published.


*