2026 Cal AI — BreachForums dump claim (~2.83M emails / ~3M users; unverified)
Data compromised
Actor claim (unverified): dates of birth, names, genders, usernames, social media profiles, PIN codes, subscription details, height/weight; ~2.8M unique emails (many Apple Private Relay). MyFitnessPal acquisition context — not a confirmed MyFitnessPal core breach.
Technical writeup
Unverified leak-site / forum claim — indexed from XposedOrNot H1 2026 catalog (CalAI, 2,830,009) and March 2026 trade press. On March 9, 2026 BreachForums user vibecodelegend claimed a Cal AI breach and posted a dump advertised as ~3M users / ~12 GB, including ~2.8M unique emails. Cal AI had just been acquired by MyFitnessPal (TechCrunch Mar 2). At indexing time the company had not published a matching confirmation of the BreachForums corpus. Distinct from the 2018 MyFitnessPal / Under Armour 150M incident. recordsAffected 2830009 from XON/actor census (unverified); companyConfirmed false.
Root cause
Unverified BreachForums claim by alias vibecodelegend of Cal AI database theft (~12 GB)
References
- https://hackread.com/cal-ai-myfitnesspal-data-breach-3m-users/
- https://www.kiteworks.com/cybersecurity-risk-management/cal-ai-data-breach-3-million-users-health-data-exposed/
- https://blog.xposedornot.com/h1-2026-breach-report/
- https://techcrunch.com/2026/03/02/myfitnesspal-has-acquired-cal-ai-the-viral-calorie-app-built-by-teens/