Loading story…
Basic-Fit, Europe’s largest budget gym chain by club count, disclosed that hackers breached its membership visit-registration system and stole personal data belonging to about 1 million members across several European countries, including roughly 200,000 in the Netherlands. The company said it detected the intrusion and stopped the unauthorized access within minutes, but not before attackers downloaded a substantial volume of customer information from a central system used across multiple countries.
The exposed data included names, addresses, email addresses, phone numbers, dates of birth, bank account details, subscription status, and recently visited gym locations. Basic-Fit said passwords and identity documents were not stored in the affected environment and have not been found among the stolen data. The company notified the Dutch Data Protection Authority under GDPR requirements, informed affected members directly, and warned customers to remain alert for phishing attempts while the investigation into the unidentified attackers continues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following the breach, Basic-Fit notified the Dutch Data Protection Authority under GDPR requirements, launched an investigation, and directly informed affected members. The company said it had not found evidence of misuse of the stolen data and advised customers to remain alert for phishing attempts.
Basic-Fit confirmed that a significant data breach exposed personal and membership-related data for about 1 million members, including roughly 200,000 in the Netherlands. Exposed data included names, addresses, email addresses, phone numbers, dates of birth, bank account details, subscription status, and recently visited gym locations; the company said passwords and identity documents were not affected.
Unknown attackers gained unauthorized access to Basic-Fit's central membership visit-registration system and downloaded customer data before the intrusion was stopped within minutes. The affected system stored member information from multiple European countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcezdnet.fr
Open sourceteiss.co.uk
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
Rituals, the Netherlands-based cosmetics retailer, confirmed that attackers accessed and downloaded data from its **My Rituals** membership database, exposing customer records across Europe, the United Kingdom, and some customers in the United States. The company said the stolen information may include full names, dates of birth, gender, postal and email addresses, phone numbers, preferred store, and account type, while stating that **passwords and payment data were not accessed**. Rituals said it detected the unauthorized downloads in April, blocked the attackers' access, notified relevant authorities, and opened a forensic investigation. The company has not disclosed how the intrusion occurred, how many people were affected, or whether any ransom demand was made, though the loyalty program reportedly has more than **41 million members**. Rituals also said it has not found evidence that the stolen data has been leaked online and has not attributed the breach to a known threat actor.
Jun 29, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026