Affected users told the news site that were angry that Fitbit's response to the cyber-breach, saying the company had failed to respond quickly and that Fitbit had been "blaming the users for the security issues."
Fitbit, which denied claims that it hadn't handled the breaches appropriately, refused to reveal how many users have had their accounts compromised other that calling the number a "small proportion" of users, according to BuzzFeed.
A spokeswoman for Fitbit said that the company's computer servers themselves were "not hacked."
"We take the security of our customers' accounts very seriously, so as a precaution, we took measures to reset the passwords of affected users and prompt those users to create new passwords," the spokeswoman said. "To prevent this type of activity in the future, we recommend that customers avoid reusing passwords associated with their email address or any other accounts, as this practice leaves them more vulnerable to this type of malicious behavior. Our investigation found that the accounts that were accessed by an unauthorized party had 'leaked' credentials [email addresses and passwords], compromised previously from other third-party sites, unrelated to Fitbit."
The spokeswoman added that the company has found no evidence that customers' GPS information has been accessed. And, she said, "Customers using 'log in with Google' can make use of multifactor authentication today." The company is also developing a similar multifactor authentication for Fitbit.com accounts with the goal of making that feature available later in 2016."