Claimed leak at MaSalleDeSport - unspecified volume

On 22 February 2026, MaSalleDeSport — a French software vendor supplying CRM, mobile-app and management tools to more than 2,000 gyms — was claimed to have been compromised in a supply-chain attack with downstream impact on several major fitness chains, including Basic-Fit, Fitness Park, ON AIR Fitness and L'Orange Bleue.

A hacker operating under the handle "84City" — already linked to claimed breaches of ON AIR Fitness and Keep Cool — said they had gained access to the provider's back-end and exfiltrated customer data from the gyms it serves. Because the data flowed through a single shared provider, the breach potentially reaches well over 1 million gym members across the affected networks. The attacker also claimed to retain access to sensitive internal interfaces covering customers, billing and franchise data, suggesting a persistent compromise rather than a one-off dump.

According to the claim and the data samples circulated, the exposed information includes:

• Full names (first and last)
• Phone numbers
• SMS / text-message content
• Postal addresses (in some cases)
• Gym-membership and franchise/billing records

As of the disclosure date the breach was a hacker claim backed by published samples; the full volume was not independently confirmed, and the attacker reportedly still held access to the provider's interfaces. The exposure of names, phone numbers and addresses raises a high risk of targeted phishing and identity fraud against affected gym members.