Now that the Basic-Fit data breach has been made public, the question is inevitable: What now? We’ll explain what you should do as a customer and how to protect yourself against phishing if you receive suspicious messages in the coming days.
Basic-Fit is a well-known gym chain , headquartered in the Netherlands with locations in several European countries. In Spain, it has over 150 centers, and if you’ve heard about them recently, it’s because of a data breach affecting Basic-Fit customers, impacting one million members in countries such as Germany, Belgium, Spain, France, Luxembourg, and the Netherlands. While the majority of those affected, around 200,000, are in the Netherlands, the Basic-Fit hack could affect any customer.
Cyberattacks to steal personal data are commonplace. The dark web is rife with announcements of data breaches targeting agencies, public bodies, and service providers. Looking back, in recent months we’ve seen data thefts from companies like Endesa, Movistar, Repsol, the Spanish Tax Agency , and the Directorate General of Traffic . This time, the target is a popular gym chain, Basic-Fit .
Taxpayer, user, and customer data is valuable . Cybercriminals use it to extort money from companies and organizations in exchange for not leaking it. They also make money by selling this data to third parties for use in online scams and phishing schemes. This involves impersonating another company or public authority to obtain your bank details , sign up for services in your name, and ultimately, profit financially. The good news is that all is not lost. With a little common sense, you can stay safe from phishing.
The Basic-Fit data leak
On Monday, April 13, Basic-Fit informed “a number of our members about an unauthorized download of Basic-Fit data.” This data breach affects nearly one million customers in several European countries. Specifically, this gym chain operates in twelve countries, including Spain.
According to several media outlets, the Basic-Fit hack occurred in the computer system that records user visits to its facilities. This unauthorized access allowed cybercriminals to steal customers’ personal information . Basic-Fit states that this data is as sensitive as names, surnames, physical addresses, email addresses, telephone numbers, dates of birth, national identity card numbers, and bank details associated with gym memberships. The leak even includes information about unpaid fees.
In these types of situations, it’s impossible to know for sure which customers have been affected by the security breach. That’s why Basic-Fit has contacted some of its customers, but not all. The company has provided a series of questions and answers for those who haven’t yet been contacted and want to know the extent of the leak. The first question states that if “you haven’t received an email from us about this, then your data isn’t affected by the unauthorized download.” But it ‘s always better to be safe than sorry .
What to do after the Basic-Fit hack
When there’s a security breach at a company that holds our data, it’s easy to feel powerless. When you share personal information, you assume it will be protected from falling into the wrong hands. According to Basic-Fit, “unauthorized access was stopped within minutes of being detected,” and they reported “the incident to the appropriate authorities.” But those few minutes have been enough to make all their customers more cautious than usual in the coming days, weeks, and months.
Basic-Fit recommends checking your email to see if you’ve been included on the list of members affected by the Basic-Fit hack. However, if you are a member of this gym chain, you should definitely take certain precautions. Although the affected data is not publicly available , it could eventually fall into the wrong hands.
The stolen data can be used to create phishing campaigns . This means you could soon receive phone calls, SMS messages, WhatsApp messages, or emails impersonating Basic-Fit , your bank, or any other company with millions of customers. Phishing is an easy and cheap way to steal data, allowing scammers to send millions of messages. Most go unanswered, but someone might fall for it.
Basic-Fit states that user passwords have not been compromised. So, in principle, you don’t need to change yours. However, be careful with any messages you receive. Make sure they are legitimate. Keep in mind that they will never ask for additional information via email or text message . “Close the message or hang up immediately. Contact the organization directly using their official website or phone number to verify the message’s authenticity.”
