Basic-Fit: Personal data of 1 million gym members compromised in Basic-Fit security incident

Basic-Fit Data Breach Exposes Personal Data of 1 Million Gym Members

On April 14, 2026, Basic-Fit, Europe’s largest gym chain, disclosed a data breach affecting approximately 1 million members across multiple countries. The incident involved unauthorized access to company systems, resulting in the theft of personal data, including names, addresses, email addresses, phone numbers, birth dates, and bank account details.

The breach was detected through Basic-Fit’s system monitoring processes, and the intrusion was halted within minutes. While no ID documents or passwords were compromised, external security experts confirmed that intruders downloaded member data. Around 200,000 of the affected individuals are based in the Netherlands. Basic-Fit has notified relevant data protection authorities and informed impacted members, though no evidence of data misuse has been found to date.

Basic-Fit operates over 1,600 clubs in six countries, serving more than 5 million members. The company reported €1.42 billion in revenue in the previous year. The identity of the attackers remains unknown, and no ransomware group has claimed responsibility for the breach. Investigations and monitoring are ongoing with the assistance of external specialists.

Source: https://securityaffairs.com/190815/data-breach/personal-data-of-1-million-gym-members-compromised-in-basic-fit-security-incident.html

Basic-Fit cybersecurity rating report: https://www.rankiteo.com/company/basic-fit

"id": "BAS1776198528",
"linkid": "basic-fit",
"type": "Breach",
"date": "8/2015",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '1,000,000',
                        'industry': 'Fitness/Gym',
                        'location': 'Europe (Netherlands, Belgium, Luxembourg, '
                                    'France, Spain, Germany)',
                        'name': 'Basic-Fit',
                        'size': 'Large (1,600+ clubs, 5M+ members)',
                        'type': 'Company'}],
 'attack_vector': 'Unauthorized Access',
 'customer_advisories': 'Impacted members informed',
 'data_breach': {'data_encryption': 'No (ID documents or passwords not '
                                    'compromised)',
                 'data_exfiltration': 'Yes',
                 'number_of_records_exposed': '1,000,000',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Names',
                                              'Addresses',
                                              'Email addresses',
                                              'Phone numbers',
                                              'Birth dates',
                                              'Bank account details']},
 'date_detected': '2026-04-14',
 'date_publicly_disclosed': '2026-04-14',
 'description': 'On April 14, 2026, Basic-Fit disclosed a data breach '
                'affecting approximately 1 million members across multiple '
                'countries. The incident involved unauthorized access to '
                'company systems, resulting in the theft of personal data, '
                'including names, addresses, email addresses, phone numbers, '
                'birth dates, and bank account details. The breach was '
                'detected through Basic-Fit’s system monitoring processes, and '
                'the intrusion was halted within minutes. While no ID '
                'documents or passwords were compromised, external security '
                'experts confirmed that intruders downloaded member data. '
                'Around 200,000 of the affected individuals are based in the '
                'Netherlands. Basic-Fit has notified relevant data protection '
                'authorities and informed impacted members, though no evidence '
                'of data misuse has been found to date.',
 'impact': {'data_compromised': 'Personal data (names, addresses, email '
                                'addresses, phone numbers, birth dates, bank '
                                'account details)',
            'identity_theft_risk': 'High',
            'payment_information_risk': 'High'},
 'investigation_status': 'Ongoing',
 'references': [{'source': 'Cyber Incident Description'}],
 'regulatory_compliance': {'regulations_violated': ['GDPR'],
                           'regulatory_notifications': 'Yes (relevant data '
                                                       'protection authorities '
                                                       'notified)'},
 'response': {'communication_strategy': 'Notified data protection authorities '
                                        'and impacted members',
              'containment_measures': 'Intrusion halted within minutes',
              'enhanced_monitoring': 'Ongoing investigations and monitoring',
              'incident_response_plan_activated': 'Yes',
              'third_party_assistance': 'External security experts'},
 'title': 'Basic-Fit Data Breach Exposes Personal Data of 1 Million Gym '
          'Members',
 'type': 'Data Breach'}