Hack at Dutch gym chain Basic-Fit exposes customer data in several EU countries

Unknown hackers breached the systems of European gym chain Basic-Fit and downloaded personal data belonging to members across several countries, the company said in a statement on Monday.

The Netherlands-based company claimed the breach involved information including names, addresses, phone numbers, email addresses, dates of birth and bank details, as well as membership data such as subscription numbers, subscription types and recent gym visits. Passwords and identity documents were not accessed, according to the company.

“The investigation so far has not shown the data being available anywhere or having been misused,” the statement said.

According to Dutch media reports, the intrusion targeted a central system that stores member data from multiple countries. The breach reportedly affected customers in Belgium, the Netherlands, Luxembourg, France, Spain and Germany. In total, data belonging to around 1 million members was compromised, including about 200,000 customers in the Netherlands.

Basic-Fit said the intrusion was detected and stopped within minutes, but some data had already been downloaded by that time. The company reported the breach to the Dutch Data Protection Authority and launched an investigation into how the attackers gained access and who may be responsible.

The company has notified affected members by email, warning them to remain alert for potential phishing attempts but saying no further action is required at this time.

Basic-Fit is one of Europe’s largest gym chains, operating more than 2,150 gyms in 12 countries and serving roughly 5 million members.

Several users in Spain, France and the Netherlands said on social media that they had received emails from the company warning about the breach.

"With this message, we inform you about an unauthorized download of Basic-Fit data," the email reads.