Basic-Fit was impacted by a cyberattack that affected members in several countries, with 200,000 of them located in the Netherlands.

      The breach revealed names, addresses, email addresses, phone numbers, dates of birth, and bank account information. No passwords or identity documents were compromised. The Dutch Data Protection Authority has been informed. Basic-Fit operates over 1,300 fitness clubs across seven European nations.

      Basic-Fit, the largest budget fitness chain in Europe by the number of clubs, has reported a data breach affecting members in several countries, including around 200,000 individuals in the Netherlands whose data was compromised. The company confirmed that it notified the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) after discovering unauthorized access to the system used for tracking member visits to its gyms.

      The exposed data comprises membership details, names, home addresses, email addresses, phone numbers, dates of birth, and bank account information. Basic-Fit asserted that it does not store identity documents, such as passports or driving licenses, and that no passwords were compromised in the breach.

      The attack specifically targeted the club check-in and visit-registration system, which records member access via turnstiles at each site. Basic-Fit operates in seven European countries: the Netherlands, Belgium, Luxembourg, France, Spain, Germany, and Austria.

      The presence of bank account information in the leaked data poses a major concern for affected members. Coupled with names and dates of birth, IBAN numbers and banking details facilitate the potential for SEPA direct debit fraud and financial impersonation. Basic-Fit's privacy policy indicates that the company collects bank account numbers from all members during the subscription process to manage recurring membership payments.

      Affected members are advised to closely monitor their accounts and remain vigilant against phishing attempts that may leverage the exposed personal information to appear legitimate.

      This breach emerges during a challenging time for data security in the Netherlands. In February 2026, telecom operator Odido, formerly T-Mobile Netherlands, experienced what cybersecurity experts termed one of the largest data breaches in Dutch history, exposing the personal data of around 6.2 million customer accounts through an attack on its customer relationship management system. This incident included IBAN numbers, passport information, and dates of birth. While the Basic-Fit breach is significantly smaller, it follows a similar trend of attacks targeting systems that contain large amounts of customer identity and financial data.