
This week MyFitnessPal announced that it had suffered a massive security breach which exposed or compromised 150 million MyFitnessPal accounts. Data that is affected included usernames, email addresses and hashed passwords. Luckily for those affected, the company claims that the affected data did not include government-issued identifiers or payment card data.
In some good news for MyFitnessPal users, the stolen passwords were encrypted. However, Under Armour continues to be vague about which percentage of the stolen data was protected by bcrypt, a secure algorithm employing key stretching, and what used SHA-1, a legacy hashing algorithm no longer considered to be “any good”.
That such data breaches occur should no longer be a surprise to anyone particularly given other high-profiles breaches involving companies such as Equifax, Yahoo and Target. However, what is surprising in this case is that cybersecurity experts are beginning to commend Under Amour for their “prompt response to the data breach after its discovery and their public announcement alerting users to the danger”.
Such praise for simply engaging in what most consumers would consider obvious moral behavior may shock many Americans. After all, isn’t it intuitive and legally responsible of companies that suffer data breaches to engage in proactive disclosure?







