Apr 14, 2026 · 5 min read
Basic-Fit Lost 1 Million Gym Members' Bank Details—The Breach Was Over in Minutes But the Damage Was Done
Hackers hit Europe's largest gym chain and walked away with names, addresses, dates of birth, and bank account numbers from customers in six countries.
What Happened
On April 13, 2026, Basic-Fit disclosed that hackers had breached its systems and downloaded personal data belonging to approximately 1 million members. The Dutch fitness chain, which operates over 1,700 gyms across Europe and serves 4.5 million customers, said the intrusion was detected and stopped within minutes. But by the time the company's security team intervened, the attackers had already extracted a significant volume of data.
The breach affected members in the Netherlands (around 200,000), Belgium, Luxembourg, France, Spain, and Germany. Franchise gym customers were spared because their data is stored on separate systems.
What Data Was Stolen
The stolen data includes a combination of personal and financial information that makes this breach particularly dangerous:
- Personal details: full names, home addresses, email addresses, phone numbers, and dates of birth
- Financial data: bank account details (IBAN numbers)
- Membership data: subscription numbers, subscription types, and recent gym visit history
Basic-Fit confirmed that passwords and identity documents were not compromised. However, the combination of bank details with full personal information gives attackers everything they need to attempt direct debit fraud, phishing campaigns, or identity theft.
Why Bank Details Make This Worse
Most data breaches expose emails and passwords. This one exposed bank account numbers. In the European SEPA payment system, an IBAN is enough to set up a direct debit authorization. While banks have fraud detection systems, attackers who also possess the victim's name, address, and date of birth can craft convincing authorization requests.
The risk extends beyond financial fraud. With a full name, date of birth, home address, and bank details, an attacker has the building blocks for identity theft across multiple services. The gym visit history, while seemingly harmless, adds another layer: it reveals daily routines and physical location patterns.
Basic-Fit's Response
The company said it notified affected members directly and reported the incident to data protection authorities in the affected countries. Basic-Fit stated that its investigation has not found evidence of the stolen data being published online or misused so far.
The "stopped within minutes" framing deserves scrutiny. While rapid detection is better than the months long delays seen in other recent breaches, automated exfiltration tools can download gigabytes of data in seconds on a fast connection. Minutes was more than enough time for attackers to grab 1 million records.
What Affected Members Should Do
If you are a Basic-Fit member in any of the affected countries, take these steps now:
- Monitor your bank account. Watch for unauthorized direct debits or unfamiliar transactions. Set up alerts for all outgoing payments if your bank offers them.
- Be suspicious of unexpected contacts. Attackers may use your stolen data to craft targeted phishing emails or phone calls that reference your gym membership, making them appear legitimate.
- Consider a new IBAN. If your bank allows it, request a new account number. This is the most effective way to neutralize stolen banking credentials.
- Watch for identity fraud. With your full name, address, date of birth, and bank details in play, check your credit reports regularly for accounts you did not open.
The GDPR Question
Basic-Fit operates entirely within the European Union, where GDPR requires organizations to protect personal data and report breaches within 72 hours. The company appears to have met the notification timeline, but regulators will examine whether adequate security controls were in place before the breach occurred.
The fact that bank details were stored alongside personal information, rather than in a separately secured system, may attract regulatory attention. Under GDPR, financial data warrants heightened protection measures. Companies like Intesa Sanpaolo have faced fines exceeding €30 million for failing to adequately safeguard financial records.
With data protection authorities in six countries now notified, Basic-Fit could face coordinated enforcement action if investigators find that the company's security posture did not match the sensitivity of the data it held. The breach is part of a growing wave of European retail attacks: days later, Rituals' 41 million member loyalty database was hit in a similar incident.