Jefit 2020 Data Breach

Jefit says it discovered a data event caused by a security bug after receiving several user reports; secured its servers and affected accounts; patched the bug; conducted a forensic investigation; and contacted law enforcement. The company notice says that accounts registered before September 20, 2020 might have been affected.

The company statement does not provide the exact initial access day, actor, or data-acquisition period. August 11 is therefore retained as the verified external record date, not presented as an exact access day disclosed by the company. March 19, 2021 is the date of the public notice, not a separate breach.

The company notice lists the account username, email address associated with the account, password hashed with a unique salt for each account, and IP address recorded when the account was created. It also says that not every account had an IP address. Because payments were handled by third-party stores or payment companies, Jefit says it did not store customer payment information and that no financial data was involved.

The verified external record reports that passwords appeared as vBulletin or Argon2 hashes and that several million cracked passwords later circulated. That technical detail comes from analysis of the external dataset; it does not mean the company stated that every account used the same algorithm or had been cracked. Health records, workout history, private messages, payment cards, and bank accounts are not confirmed data classes.

The 9,052,457 value is the number of unique email addresses in the verified external dataset. The production one-column job processed 9,034,605 email lines and created 9,033,145 unique email associations. The local file was normalized from the email column in the Jefit source structure; passwords, usernames, and IP addresses were not imported.

The local unique-email count is 19,312 below the external measure. Because dataset version, normalization, and deduplication differences are not reconciled by the sources, the values are not combined. A local match establishes email only; it does not prove that a password, username, or IP was present for the same person.

If a password used with Jefit in 2020 was also used for another service, it should be replaced there with a unique password, and multi-factor authentication should be enabled where available. The company's own notice also encourages existing users to replace their Jefit password with a stronger combination.

Instead of following links in unexpected membership, workout-plan, device-linking, or password-reset messages, users should open Jefit's address or app directly. An email match does not establish exposure of financial, health, or workout data; the confirmed boundary is email, username, account-creation IP, and a password hash.