Security researcher Oliver Hough discovered that a popular fitness app company, PumpUp, left a backend server exposed to the internet without a password, allowing unauthorized access to over six million users’ private and sensitive data. The exposed server, hosted on Amazon’s cloud, contained users’ email addresses, personal information entered into the app, full resolution profile photos, IP addresses, session tokens, and, in some cases, unencrypted credit card data including card numbers, expiration dates, and card verification values. The NJCCIC recommends PumpUp app users review the ZDNet report and change their passwords for all accounts associated with the app immediately. Additionally, we recommend administrators of Amazon cloud services review our previous NJCCIC Cyber Alert on the risks associated with misconfigured databases, audit their security settings, and implement the mitigation strategies provided as soon as possible.