Data breach at French climbing-gym chain Climb Up exposes customer files

On 15 October 2026, Climb Up — one of France's largest indoor climbing-gym chains — published a notice disclosing that an unauthorized third party had obtained personal data from its customer files. Signed by the company's IT director and data protection officer, the notice says Climb Up became aware of the leak on 14 October 2026 and that a security flaw, since identified and immediately fixed, was the cause.

The exposed data, from client records created between 2016 and March 2026, includes first and last names, date of birth and age, postal address (not always filled in), phone number and email address, the gym and client-file number, and the record's creation, last-modified and last-activity dates. The notice adds that the details of a linked online account (name, date of birth, email) and those of people attached to the file — children, parents, siblings, a spouse or other relatives, with their names and dates of birth — are among the affected data. Climb Up stresses, however, that no passwords and no banking or card details were exposed.

Response and notification

The company says it fixed the vulnerability as soon as it was discovered, notified the CNIL (France's data protection authority) and filed a complaint with the public prosecutor. It announced that every directly affected person would receive a personal email. The notice does not give a number of people affected, does not mention ransomware, and does not say whether the access occurred at a service provider or within Climb Up's own systems.

Context

The disclosure fits a continuing run of data breaches hitting French leisure and sports organisations through 2026, in which customer files rich in personal data — including on minors and relatives — are left exposed. The absence of passwords and banking data limits the risk of direct financial fraud, but the combination of identities, contact details and family links remains usable for targeted phishing.