HackingDelayed DiscoveryCREDENTIALSIDENTITY_BASICLowActive
MyFitnessPal, Inc.
bd_b68489de0920def6 · schema v1 · pii pii-v1
Full breach record for MyFitnessPal, Inc. →Under Armour, Inc. (parent of MyFitnessPal) disclosed that an unauthorized party acquired MyFitnessPal user data (usernames, emails, hashed passwords) in February 2018. The breach was discovered on March 25, 2018. No SSNs or payment data were affected. Under Armour engaged forensic firms, notified law enforcement, and mandated password resets.
California clockDiscovered Mar 25, 2018 → Notified Mar 29, 20184d ✓ CA 60-day OK4 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-134903
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 29, 2018
- Raw hash
- 4bb2925f07768f4b2ae7a695456c70fbc439fcc746ead8c78df149d2be34bb92
Reporting entity
- Name
- UNDER ARMOUR, INC.norm: under armour
- Domain
- underarmour.com
Victim entity
- Name
- MyFitnessPal, Inc.norm: myfitnesspal
Incident
- Discovered
- Mar 25, 2018
- Materiality determined
- —
- Notification sent
- Mar 29, 2018
- Affected individuals
- Not disclosed
- Data types
- CREDENTIALSIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
Compliance
- Time to disclose
- 4 days(4 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 4d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 25, 2018→ Notified: Mar 29, 20184d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.