Were my bank details or direct-debit instructions exposed?

Per reporting by BleepingComputer and Help Net Security, bank account numbers were among the data exposed for members on direct-debit billing. On its own, knowing your IBAN does not let an attacker withdraw funds (SEPA Direct Debit requires a valid mandate), but it is useful for phishing attempts that ask you to 'verify' or 'update' your direct debit. Members should monitor their statements for unfamiliar transactions and contact their bank if anything looks wrong.

Was my password exposed?

Basic-Fit has not reported that account passwords were part of the exposed dataset. However, where the same email and password are reused on other sites, those accounts are still at risk. Updating your Basic-Fit password is good practice after any incident of this kind.

What about my gym attendance / scan-in history?

Attendance and scan-in records were not part of the exposed data, according to Basic-Fit. The breach was centred on member-management records (contact, contract and billing metadata) rather than activity logs.

Can I cancel my Basic-Fit membership because of the breach?

Membership cancellation rights are governed by your country's consumer-protection rules and your contract terms. In several EU jurisdictions, a serious data breach can give consumers stronger grounds for contract termination, but you should seek advice or contact your local consumer-protection authority for specifics.

How do I know if my data was in the breach?

Basic-Fit has been emailing affected members directly. If you are a current or former Basic-Fit member and have not received a notification, your data may not be part of the exposed set, but the company has indicated notifications are ongoing. You can also check your email against known breaches using In The Event Of’s free breach checker.

Basic-Fit Data Breach 2026:
What You Need to Know

European gym chain Basic-Fit reported on 13 April 2026 that a breach exposed details of approximately one million members. Names, contact details, addresses, membership contracts and partial payment metadata were among the exposed fields.

Disclosed:13 April 2026

Records affected:~1 million

Risk level:High

Your personal risk from this breach

View My Risk

What Happened

How the Basic-Fit Breach Unfolded

8 April 2026

Unauthorised access occurred to the Basic-Fit system that records members' visits to the company's clubs. Basic-Fit later said it blocked the intrusion within minutes of detection, though personal data had already been downloaded by the attackers.

13 April 2026

Basic-Fit publicly disclosed the incident via a press release from Hoofddorp, confirming that approximately 1 million members across the Netherlands (~200,000), Belgium, Luxembourg, France, Spain and Germany were affected. Exposed fields included names, addresses, email, phone, dates of birth and bank account details.

April 2026

Basic-Fit notified national data-protection regulators in the Netherlands (lead supervisor), France, Belgium, Luxembourg, Spain and Germany. Affected members received emails with details of the specific fields exposed. Basic-Fit said its investigation had not found evidence the data had been leaked online (as opposed to merely downloaded by the attacker).

Basic-Fit operates more than 1,400 clubs across Europe; affected members include customers in the Netherlands, Belgium, Luxembourg, France, Spain and Germany.

What Was Exposed

Personal Data Leaked in the Breach

Data Type	Risk Level	Who Was Affected
Full name	High	Approximately 1 million affected members
Email address	High	Approximately 1 million affected members
Phone number	High	Approximately 1 million affected members
Home address	High	Subset of affected members (direct-debit setup)
Date of birth	High	Approximately 1 million affected members
Bank account number	High	Members on direct-debit billing
Membership tier / contract details	Medium	Approximately 1 million affected members

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Contact + billing-context data is rated higher because it is the most common ingredient in convincing subscription-fraud phishing.

✅ Confirmed NOT Exposed

Basic-Fit has stated that identification documents and account passwords were not part of the exposed dataset. CVV values and full credit-card primary account numbers (PANs) were also not stored in the affected system. Gym attendance and scan-in records were not included.

Company Response

What Basic-Fit Did

“We have taken steps to secure the affected systems and are working with the relevant authorities. We sincerely apologise to our members for the inconvenience and concern this causes.”
Basic-Fit statement, April 2026

Actions Taken by Basic-Fit

Isolated the affected member-management environment
Notified the Dutch Data Protection Authority and other EU regulators in markets where Basic-Fit operates
Engaged external cyber forensics specialists to confirm scope
Began emailing affected members with details of the specific fields exposed for their record
Published guidance on identifying phishing impersonating Basic-Fit or member-services representatives
Reviewed access controls for vendor and contractor accounts

Basic-Fit About Dutch DPA

What Now?

Steps You Can Take After the Basic-Fit Breach

The biggest risk from this breach is phishing and billing fraud. The combination of name email phone and partial billing metadatais everything a scammer needs to impersonate Basic-Fit support and trick members into “updating” their direct-debit details.

Basic-Fit and Fitness Accounts

Your gym membership details were exposed. Other fitness or wellbeing accounts may use the same email.

Secure your Basic-Fit account

~5 min

Update the password on your Basic-Fit member portal and enable two-factor authentication where available. Review your stored payment method and contract details, and remove any saved cards you no longer use.

Basic-Fit member area

Review other fitness and wellbeing accounts

Where the same email and password combination has been used across Strava, Garmin Connect, Apple Fitness, Fitbit, MyFitnessPal, or other wellness platforms, consider updating credentials there too.

Email and Digital Identity

Your email is the key to your digital identity. Securing it is a sensible first step.

Strengthen email security

~5 min

Updating the password and enabling MFA on email accounts associated with the breach is widely recommended. It is also worth checking email forwarding rules and connected app permissions, as these can be exploited to silently intercept communications.

Understand your full account exposure

Most people have dozens of online accounts linked to a single email address. When that email is exposed in a breach, understanding which services are connected is a critical first step in assessing personal risk. Tools that map your digital footprint can help identify accounts that may need attention.

Identity and Payment Protection

Watch for fake 'billing update' emails impersonating Basic-Fit.

Monitor direct-debit and card statements

~10 min

Check your bank statements for the next several months for any unfamiliar Basic-Fit-styled transactions. Scammers may attempt small 'test' charges before larger fraudulent ones. Banks in the EU generally provide chargeback rights for unauthorised direct debits, so contact yours quickly if you notice anything unusual.

Treat 'update your billing details' emails as suspicious

Expect emails claiming to be from Basic-Fit asking you to 'update your IBAN' or 'confirm your payment method' via a link. Always sign in directly via my.basic-fit.com rather than clicking through; legitimate Basic-Fit communications about billing will direct you to the member portal.

Set a SIM lock or port-out PIN

~10 min

Where phone number was part of the exposed data, contacting your mobile carrier to set a port-out PIN is a practical safeguard against SIM-swap fraud, which is sometimes used to intercept verification codes for banking apps.

Monitoring and Reporting

Resources for breach response in the EU and Australia.

Report to your national Data Protection Authority

EU residents can lodge a complaint with their national DPA under GDPR. The Dutch DPA is the lead supervisor for Basic-Fit; your home-country DPA can also help.

Australian residents: contact IDCare

IDCare (1800 595 160) is Australia's national identity and cyber support service. They can help even for breaches at overseas brands where Australian residents are affected.

Not sure which of your accounts are affected?

In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.

Check My Email Free

Are You Still at Risk?

Compound Risk: Basic-Fit Plus Other Subscription Leaks

The Basic-Fit dataset is most useful to attackers when paired with other subscription / direct-debit data. Combine it with a previous bank-credential phishing campaign and the result is a high-conversion fraud kit.

Why this matters

Subscription billing fraud has been one of the fastest-growing fraud categories across the EU. Members with multiple subscriptions (gym, streaming, mobile, energy) are targeted by phishing that references real subscription details from a breach to make the ‘billing update’ request feel legitimate.

Ticketmaster (2024)560M records - name, address, partial payment metadata
MOAB (2024)26B records - aggregated credentials for stuffing
LinkedIn (2021)700M records - phone, employer, profession
Booking.com (2026)Names, emails, addresses - travel-themed phishing vector

In The Event Of can overlay your subscription footprint with known breaches and tell you exactly where you need to verify billing details directly.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

Basic-Fit Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

NYC Health + Hospitals Data Breach 2026

~1.8M records exposed

Critical

Australian Courts Data Breach 2026

Thousands of files records exposed

Critical

youX Data Breach 2026

~444K records exposed

High

Prosura Data Breach 2026

300K-500K records exposed

High

Canvas (Instructure) Data Breach 2026

~275M (claimed) records exposed

Medium

Booking.com Data Breach 2026

Undisclosed records exposed

High

McGraw Hill Data Breach 2026

13.5M records exposed

High

Crunchyroll Data Breach 2026

Undisclosed records exposed

High

Eurail Data Breach 2026

300K+ records exposed

High

Under Armour Data Breach 2025

72M records exposed

High

Salesforce (ShinyHunters) Data Breach 2025

~1B records exposed

High

Allianz Life Data Breach 2025

2.8M records exposed

High

Workday Data Breach 2025

Undisclosed records exposed

Medium

Western Sydney University Data Breach 2025

10K records exposed

High

Genea Fertility Data Breach 2025

940K records exposed

Critical

DeepSeek Data Breach 2025

1M records exposed

Medium

Tangerine Telecom Data Breach 2024

232K records exposed

High

Australian Clinical Labs Data Breach 2022

223K records exposed

Critical

Qantas Data Breach 2025

5.7M records exposed

High

Optus Data Breach 2022

9.8M records exposed

Critical

Medibank Data Breach 2022

9.7M records exposed

Critical

Latitude Financial Data Breach 2023

14M records exposed

Critical

MyDeal (Woolworths) Data Breach 2022

2.2M records exposed

High

View all breach guides →

Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with Basic-Fit N.V. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.

Basic-Fit Data Breach 2026:What You Need to Know

How the Basic-Fit Breach Unfolded

Personal Data Leaked in the Breach

✅ Confirmed NOT Exposed

What Basic-Fit Did

Actions Taken by Basic-Fit

Steps You Can Take After the Basic-Fit Breach

Compound Risk: Basic-Fit Plus Other Subscription Leaks

Why this matters

Were you affected?

Basic-Fit Breach FAQ

Were my bank details or direct-debit instructions exposed?

Was my password exposed?

What about my gym attendance / scan-in history?

Can I cancel my Basic-Fit membership because of the breach?

How do I know if my data was in the breach?

Other Major Australian Data Breaches

Basic-Fit Data Breach 2026:
What You Need to Know