Basic-Fit, the largest fitness operator and gym franchisor in Europe, has confirmed a data breach affecting around 200,000 members in the Netherlands alone, with around 1 million affected across the continent.

The company said it has informed those members whose data has been accessed and notified the relevant data protection authority in the Netherlands.

A company spokesperson told Reuters that the breach also involved customers in five other countries, including France, Germany and Spain. A further six countries operate under a franchise model and were unaffected.

Hackers gained access to a system which records members’ visits to Basic-Fit clubs. The breach was detected by Basic-Fit’s system monitoring processes, the firm said, and stopped within minutes of its discovery.

The data accessed includes membership information, name and address details, email addresses, phone numbers, dates of birth and bank account details. Basic-Fit said it does not hold members’ identification documents, and no passwords were accessed during the breach.

Basic-Fit said it is working with external security experts who have discovered that some of the data stored in the systems was downloaded by the hackers. The company added that the investigation so far has not shown the data being available anywhere or having been misused.

The fitness firm warned its members to remain vigilant to phishing emails and not to respond to requests for personal information.

Basic-Fit operates around 2,150 fitness clubs in 12 countries across Europe via two brands which have approximately 5.8 million members.

---