Database with data on 61M Apple HealthKit & fitbit accounts briefly exposed

Researchers discovered an unsecured GetHealth database with over 61 million fitness records in plain text, most detailing Fitbit and Apple HealthKit users.

Seven years after it was first announced, Apple's HealthKit is a key part in Apple Watch, iPhone, and — with the user's permission — also third party apps. Now one such third-party company has been found to be storing user data from HealthKit, Fitbit, and others, in an unsecured repository.

According to WebSitePlanet, its team and security researcher Jeremiah Fowler discovered a non-password protected database with 61,053,956 user records. The database owner, GetHealth, was informed and now reports that the database has been secured.

"In a limited sampling of 20k+ records some of the top wearable health and fitness trackers appeared as a Source," wrote Fowler in a report. "Fitbit (Purchased by Google for 2.1 Billion in 2021) appeared 2,766 times, instances of what appears to be Apple's Healthkit 17,764."

Much of the data included the users' names, date of birth, location, and more. All of it was in plain text.

"It is unclear how long these records were exposed or who else may have had access to the dataset," continued Fowler. "We are not implying any wrongdoing by Gethealth, their customers or partners."

"Nor, are we implying that any customer or user data was at risk," he wrote. "We were unable to determine the exact number of affected individuals before the database was restricted from public access."

4 Comments

GeorgeBMac 11421 comments · 8 Years

About 3 years ago

So who is this "GetHealth"? And, how do they obtain access to Apple's consumer's health data?

I can guess: a lot of third party health apps request permission to read and write to the user's HealthApp data. I suspect that that data is then stored on their servers and used for commercial purposes -- which is how all those free health apps stay in business.

It's a good reason to stick to only using Apple's activity app from your Watch. But for many, that is either not possible or it doesn't provide the services they need.

lkrupp 10521 comments · 19 Years

About 3 years ago

GeorgeBMac said:

So who is this "GetHealth"?   And, how do they obtain access to Apple's consumer's health data?

I can guess:   a lot of third party health apps request permission to read and write to the user's HealthApp data. I suspect that that data is then stored on their servers and used for commercial purposes -- which is how all those free health apps stay in business.

It's a good reason to stick to only using Apple's activity app from your Watch.   But for many, that is either not possible or it doesn't provide the services they need.

Bottom line? None of your data is safe and secure and there’s nothing you can do about it except hope you’re in a big enough school of fish that you get lucky and not eaten. Paranoia about privacy and security is useless because you cannot prevent being compromised.

GeorgeBMac 11421 comments · 8 Years

About 3 years ago

lkrupp said:

GeorgeBMac said:

So who is this "GetHealth"?   And, how do they obtain access to Apple's consumer's health data?

I can guess:   a lot of third party health apps request permission to read and write to the user's HealthApp data. I suspect that that data is then stored on their servers and used for commercial purposes -- which is how all those free health apps stay in business.

It's a good reason to stick to only using Apple's activity app from your Watch.   But for many, that is either not possible or it doesn't provide the services they need.

Bottom line? None of your data is safe and secure and there’s nothing you can do about it except hope you’re in a big enough school of fish that you get lucky and not eaten. Paranoia about privacy and security is useless because you cannot prevent being compromised.

That has a lot of truth to it.
But still, I like to limit my exposure. For instance, it's why I have insisted on Apple Pay since its inception and avoid those places that don't accept it. Apple billed it as a convenience -- which it is -- but I use it mostly for its privacy and security aspect.

If it's third party health apps storing and compromising our data, I would like to know that so I can make an informed decision on whether using their app is worth the risk to my privacy.

If it was as bad as you portray, then one of the primary features of Apple's iOS ecosystem would no longer be a feature and Android phones would become much more attractive.

mknelson 1145 comments · 9 Years

About 3 years ago

GeorgeBMac said:

So who is this "GetHealth"?   And, how do they obtain access to Apple's consumer's health data?

I can guess:   a lot of third party health apps request permission to read and write to the user's HealthApp data. I suspect that that data is then stored on their servers and used for commercial purposes -- which is how all those free health apps stay in business.

It's a good reason to stick to only using Apple's activity app from your Watch.   But for many, that is either not possible or it doesn't provide the services they need.

GetHealth appears to be an API company. So, yes, what you said.