Major Ransomware Campaign Targets 40+ Firms Across Retail, Insurance, and Hospitality Sectors A large-scale ransomware attack has compromised over 40 organizations in the retail, insurance, and hospitality industries, including high-profile companies such as Carnival, Pitney Bowes, Hallmark, and Zara. The incident, classified as a "major" cybersecurity event by the FBI, underscores the growing threat of ransomware in an era of increasingly complex IT infrastructures. The attack highlights vulnerabilities in sectors handling sensitive customer data, with recent breaches in Europe such as the Venice breach, Basic-Fit data exposure, and an Inditex incident further demonstrating the rising frequency of cyber incidents. U.S. agencies have also issued warnings about PLC attacks, while Microsoft phishing campaigns and an actively exploited Google Chrome zero-day add to the escalating threat landscape. The incident serves as a reminder that traditional backup strategies alone are insufficient against modern cyber threats, as attackers increasingly target critical systems beyond data storage. Security experts emphasize the role of Security Information and Event Management (SIEM) systems in enabling proactive threat detection and response, helping organizations identify and mitigate risks before they escalate.

Basic-Fit Hit by Data Breach Affecting Millions of European Gym Members Basic-Fit, one of Europe’s largest gym chains with over 2,150 locations across 12 countries and 5.8 million members, has suffered a cyberattack resulting in the theft of sensitive customer data. The breach, detected by the company’s monitoring systems and contained within minutes, exposed personal information including names, addresses, email addresses, phone numbers, dates of birth, and bank details. Membership data such as subscription numbers, payment status, and recent gym visits was also compromised, though passwords and identity documents remained unaffected. While Basic-Fit has not disclosed the total number of impacted members, it confirmed that affected individuals were notified. The company stated there is no current evidence of data misuse, but security experts warn that the leaked information particularly IBAN numbers could fuel targeted phishing attacks. Cybercriminals may use stolen details to craft convincing fraudulent emails, tricking victims into revealing additional financial or login credentials. The incident underscores the broader risks of data breaches, as compromised personal information enables attackers to launch highly personalized spear-phishing campaigns. Basic-Fit’s response remains under scrutiny as members assess potential exposure.

Basic-Fit Confirms Cyberattack Exposing Data of 1 Million Customers Across Europe Europe’s largest gym chain, Basic-Fit, has disclosed a cyberattack resulting in the theft of sensitive customer data, including bank details, for approximately one million members. The breach, detected through system monitoring and contained within minutes, targeted a centralized system tracking gym visits across six countries: the Netherlands, Belgium, France, Germany, Luxembourg, and Spain. The company confirmed that around 200,000 affected members are based in the Netherlands, with the remaining victims distributed across the other five nations. Stolen data includes names, home and email addresses, phone numbers, dates of birth, and bank details. Passwords and identity documents were not compromised, as Basic-Fit does not store such information. Basic-Fit operates over 2,150 gyms under its Basic-Fit and Clever Fit brands, serving 5.8 million registered members across 12 European countries. While the company has not found evidence of the stolen data being leaked or sold online, it continues to monitor the situation and has warned customers to remain vigilant against potential phishing attempts. An investigation, supported by external specialists, is underway to determine the attack’s origin and methodology. Basic-Fit has notified relevant data protection authorities and directly informed affected members.

Basic-Fit Data Breach Exposes Member Details in the Netherlands and Beyond Basic-Fit, a major European gym chain, has suffered a data breach exposing sensitive information of its members across the Netherlands and other regions. The incident, disclosed in recent reports, compromised personal details, though the exact scope of the exposed data remains under investigation. The breach affects an undisclosed number of customers, with potential risks including identity theft or targeted phishing attacks. Basic-Fit operates over 1,000 locations across Europe, making this a significant exposure for its user base. Authorities and cybersecurity experts are assessing the full impact, while the company has yet to release a detailed public statement on the cause or timeline of the breach. This incident highlights ongoing vulnerabilities in the fitness and wellness sector, where large-scale member databases remain prime targets for cybercriminals. Further updates are expected as the investigation progresses.

Basic-Fit Data Breach Exposes Personal and Financial Data of 200,000 Dutch Members Europe’s largest budget fitness chain, Basic-Fit, has reported a data breach affecting approximately 200,000 members in the Netherlands, with potential exposure across its 1,300+ clubs in seven European countries, including Belgium, Luxembourg, France, Spain, Germany, and Austria. The incident, disclosed to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), involved unauthorized access to the company’s club check-in and visit-registration system, which logs member entries via turnstiles. The exposed data includes names, home addresses, email addresses, phone numbers, dates of birth, and bank account details, though passwords and identity documents (such as passports or driving licenses) were not accessed. Basic-Fit confirmed that IBAN numbers used for recurring membership payments were among the compromised financial details, raising concerns over SEPA direct debit fraud and financial impersonation. The breach follows a pattern of recent cyberattacks in the Netherlands, including a February 2026 incident at telecom operator Odido (formerly T-Mobile Netherlands), which exposed 6.2 million customer records, including passport details and IBAN numbers. While smaller in scale, the Basic-Fit breach underscores ongoing risks to systems storing bulk customer identity and financial data. Affected members have been advised to monitor their accounts for suspicious activity and remain vigilant against phishing attempts leveraging the exposed personal information.

Basic-Fit Data Breach Exposes Personal Data of 1 Million Gym Members On April 14, 2026, Basic-Fit, Europe’s largest gym chain, disclosed a data breach affecting approximately 1 million members across multiple countries. The incident involved unauthorized access to company systems, resulting in the theft of personal data, including names, addresses, email addresses, phone numbers, birth dates, and bank account details. The breach was detected through Basic-Fit’s system monitoring processes, and the intrusion was halted within minutes. While no ID documents or passwords were compromised, external security experts confirmed that intruders downloaded member data. Around 200,000 of the affected individuals are based in the Netherlands. Basic-Fit has notified relevant data protection authorities and informed impacted members, though no evidence of data misuse has been found to date. Basic-Fit operates over 1,600 clubs in six countries, serving more than 5 million members. The company reported €1.42 billion in revenue in the previous year. The identity of the attackers remains unknown, and no ransomware group has claimed responsibility for the breach. Investigations and monitoring are ongoing with the assistance of external specialists.