Might be - I would advise to change fund password every time you have use on their website.
But it's feasible for someone gather all balances on #actifit send the #afit somewhere.
Currently thinking about how to approach the topic of letting'em know, though