Basic-Fit: 1 million customers affected, banking details exposed after a cyberattack

On 13 April 2026, Basic-Fit — Europe's largest low-cost gym chain, headquartered in the Netherlands — disclosed a cyberattack that exposed the personal and financial data of approximately 1 million members. The intrusion involved unauthorized access to the internal system that records members' check-ins at Basic-Fit clubs.

The breach affected members across six countries where the chain operates: France, Belgium, Germany, Spain, Luxembourg and the Netherlands. According to the company, attackers were able to download a combination of identity, contact and banking information from the compromised system.

The exposed data included:

• Subscription/membership information
• Full names and postal addresses
• Email addresses and phone numbers
• Dates of birth
• Banking details (IBAN)

Basic-Fit stated that no passwords were compromised and that it does not retain copies of identity documents. The company notified affected members and warned them of an elevated risk of fraud and identity theft, since the combination of an IBAN with a name and address can be used to set up fraudulent SEPA direct-debit mandates. Authorities were notified of the incident and access to the affected system was cut off.