LEAN BODY: unauthorized access to its data analysis tool

Attackers exploited a vulnerability in Metabase, the tool online fitness company LEAN BODY used for internal data analysis, and pulled customer data from its database. The first access was on 11 August, and data was taken on 31 August, 7 September and 9 September. It detected the anomaly on 8 September and on 9 September cut off the route and updated the tool. The company said its failure to regularly check vulnerability information and apply updates was most likely a cause. About 440,000 accounts, including former members, are affected, with emails, birth dates, height and weight and more. Fields also included encrypted passwords, last four card digits, billing/refund records, prefecture, and some corporate users' names, employer and employee numbers. Full card numbers and security codes were not held. The 440,000 figure counts accounts and may exceed unique people.