In 2018, MyFitnessPal had a data breach[1]. Just now, I got an email sent to me claiming to be a PayPal transaction with a giant Cancel the Payment button. I use Fastmail as an email provider with a unique email address for each account I sign up for. This scam email was sent to my MyFitnessPal email address. Of course, the scammers know I didn't authorize this [fake] transaction and really badly want me to click that gigantic Cancel button. Don't click it! Clicking it leads to a fake PayPal authentication screen where they will steal your credentials if you enter them.Scam email: https://imgur.com/a/1hqQVyy
Fake PayPal authentication website: https://imgur.com/a/yqoiEXW
Oftentimes, data acquired from breaches is not used immediately. Sometimes it can take months or years for the data to be sold to criminals that then organize scams such as this one. I wanted to let HN know about this just in case anyone else has or had a MyFitnessPal account and criminals have decided to mass-email all the stolen email addresses.
[1] https://content.myfitnesspal.com/security-information/notice.html