Apparel giant Under Armour has revealed that cyberattackers exploited a chink in the company’s armor, affecting millions of users of the business’s fitness app.

The company has announced that a data breach affected an estimated 150 million users of the MyFitnessPal app. An investigation indicated that affected information may include usernames, email addresses, and hashed passwords.

Customer payment information stored by the app, which Under Armour, collects and processes separately and has not been affected by the breach, CNBC reported.

The Baltimore-based active wear manufacturer first became aware of a potential data breach on March 25, when it discovered an unauthorized party had accessed MyFitnessPal user data in February.

Under Armour has since taken steps to warn its affected users, and is working with investigators and data security firms.

CNBC additionally reported that Under Armour’s shares dropped 3.8%, before paring losses, after the company reported the breach last week.