Basic-Fit 2026 Data Incident
The 2026 Basic-Fit data incident involved the company detecting unauthorized access on April 13, 2026 to a system used to record member visits.
The affected total is not confirmed, so severity cannot be determined from a record count alone.
Exposed Data Types
7- Membership information
- Names
- Physical addresses
- Email addresses
- Phone numbers
- Dates of birth
- Bank account details
About This Breach
Basic-Fit said access was stopped within minutes, but forensic work showed that data was downloaded. A short access period does not mean no extraction occurred; April 13 is the discovery and company-announcement date.
The company first reported approximately 200,000 active members in the Netherlands and later confirmed an approximate global scope of one million members. The Dutch subset is included in that total and is not added again. One million is an approximate notification scope, not exact dataset rows, searchable emails, or local records. No member rows are locally available.
The seven person-variable classes are membership information, names, physical addresses, emails, phones, dates of birth, and bank-account details. Passwords, identity documents, and visit histories are excluded. A notice does not establish identity, active membership, a particular gym, visit, or health status, bank-account ownership, or field co-occurrence. Membership or direct-debit requests should be verified through an independent official channel.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
