What data was stolen in the Basic-Fit breach?

The attacker accessed names, home addresses, email addresses, phone numbers, dates of birth, IBAN bank account numbers, membership details, and seven days of gym check-in records. Passwords, identity documents, and payment card numbers were not compromised.

Were Basic-Fit passwords compromised?

No. Basic-Fit confirmed that passwords and identity documents were not part of the breached system. The attack targeted the club check-in and visit-registration system, which is separate from the authentication and payment processing infrastructure.

Can someone steal money using my IBAN?

Yes — IBAN fraud is a real risk. In the SEPA system, a fraudster with your IBAN, full name, and address can initiate direct debit mandates against your account. While SEPA rules give you an 8-week unconditional refund window (13 months for unauthorized debits), the burden of detection falls on you. Contact your bank to set up a whitelist of approved creditors.

Which countries were affected by the Basic-Fit breach?

The breach affected members in six EU countries: the Netherlands (approximately 200,000 confirmed), Belgium, Luxembourg, France, Spain, and Germany. Franchise locations were unaffected as they operate separate systems.

What is Basic-Fit doing about the breach?

Basic-Fit notified the Dutch Data Protection Authority within GDPR's 72-hour window, sent email notifications to all affected members, and engaged external security experts. The company says it is continuously monitoring whether the stolen data has surfaced online.

Back to Blog

SecurityBy Ciphera Team10 min read21-04-2026

What Happened in the Basic-Fit Data Breach — and Why Your IBAN Makes It Dangerous

Security11 min read

How the Vercel Data Breach Happened — And What It Means for Every Developer

Security8 min read

DarkSword iPhone Exploit: 221 Million iOS Devices at Risk and How to Protect Yours

Security9 min read

How We Stopped a Bot Account Farming Attack With Zero-Knowledge Auth

Back to all posts

What Happened in the Basic-Fit Data Breach — and Why Your IBAN Makes It Dangerous

Related Articles

How the Vercel Data Breach Happened — And What It Means for Every Developer

DarkSword iPhone Exploit: 221 Million iOS Devices at Risk and How to Protect Yours

How We Stopped a Bot Account Farming Attack With Zero-Knowledge Auth