Basic-Fit breach steals one million gym members’ personal and bank account details
Attackers stole personal and bank account details of about one million Basic-Fit members across six European countries. Basic-Fit blocked access and notified members. Watch for convincing fake messages and unfamiliar bank transactions.
If Basic-Fit notified you, watch for messages or calls using your membership details to gain your trust; check requests through the Basic-Fit app before sharing sensitive information. Monitor your bank account and report unfamiliar transactions to your bank promptly. There is no device update to install for this breach.
What’s happening
Attackers downloaded information about approximately one million active Basic-Fit members in the Netherlands, Belgium, Luxembourg, France, Spain and Germany. The stolen records included membership information, names, addresses, email addresses, telephone numbers, dates of birth and bank account details. Basic-Fit said it blocked access within minutes of detection and had informed affected members and the relevant data protection authority by 13 April. It said no passwords were accessed and it does not hold members’ identification documents. Reuters reported that franchise operations using a separate system were unaffected. At disclosure, Basic-Fit had found no evidence of publication or misuse and was monitoring with external specialists. The search through 3 November found no later public resolution; recovery or deletion of the stolen copies remains unconfirmed. This is a service breach, with no device update for members to install.
- What
- Breach
- Affects
- Basic-Fit gym membership service
- Fixed in
- Nothing to patch
- Since
- 8 Apr 2026
- Closed
- 14 Apr 2026
Timeline
- Update
Basic-Fit confirmed to SecurityWeek that approximately one million members were affected across the Netherlands, Belgium, Luxembourg, France, Spain and Germany, including around 200,000 in the Netherlands. The company said it was unaware of the stolen data being published or misused.
- Made public
Basic-Fit disclosed that intruders had downloaded members’ personal and bank account details. It said access was stopped within minutes of detection, affected members had been informed and the relevant data protection authority had been notified.
- UpdateNothing to patch
Unauthorised access occurred in Basic-Fit’s system for recording members’ gym visits, according to the company’s account reported by El País.
Sources
- Basic-Fit informs members on an unauthorised data accessBasic-Fit · 13 Apr 2026
- Europe’s Largest Gym Chain Says Data Breach Impacts 1 Million MembersSecurityWeek · 14 Apr 2026
- Basic-Fit data breach exposes details of a million gym membersReuters · 13 Apr 2026
- Basic-Fit alerta de un ‘hackeo’ a su sistema que afecta a los datos personales y bancarios de sus clientesEl País · 13 Apr 2026