A threat actor claimed to have breached Cal AI, an AI-powered calorie-tracking app that recently acquired MyFitnessPal, and posted roughly 14.59GB of data covering more than 3 million users on a cybercrime forum. The attacker said the data came from a misconfigured, authentication-free Google Firebase backend. Leaked records reportedly include email addresses, names, dates of birth, physical measurements, subscription and transaction details, and meal logs, with some records apparently belonging to minors. Cal AI had not confirmed the breach as of reporting.