The incident, which targeted the system recording user visits, was quickly detected and blocked. However, a subsequent investigation, conducted with external cybersecurity experts, revealed that some stored information was downloaded before the intrusion could be fully contained.
Compromised data may include full names, postal addresses, email addresses, phone numbers, dates of birth, and bank details linked to membership payments. The company clarified that identity documents and passwords are not stored, so these would not have been affected.
The company states that, for now, there is no indication that the data has been disseminated or used fraudulently, but it has begun to directly inform potentially affected customers.
The news has generated considerable apprehension among Basic-Fit members in Seville, a city where the chain has significantly expanded its presence with low-cost gyms. Concern has heightened as many users rely on direct debit for membership fees, increasing fears of potential fraud.
The incident has been reported to the data protection authority in the Netherlands, where Basic-Fit is headquartered. European regulations mandate that companies report such security breaches and promptly notify affected users. The company has stated it will continue to monitor the situation with specialists and advises members to remain vigilant for any suspicious activity in their accounts.
