Synergym Customer Data Resurfaces in Alleged Breach, Company Denies Recent Attack Over 770,000 Synergym customer records including names, ID numbers, addresses, dates of birth, phone numbers, emails, and banking details (IBAN/BIC) have been advertised on a cybercrime forum, raising concerns about potential identity theft and financial fraud. The leaked data, however, appears to stem from an earlier incident in 2024, which Synergym claims was detected, mitigated, and reported to Spain’s Data Protection Agency and affected users at the time. Synergym, now part of VivaGym following an April 2024 acquisition, denies any recent breach, insisting the exposed data is not new. The company’s statement contrasts with the scale of the current leak, which far exceeds the 300,000 members it reported at the time of the acquisition. While Synergym maintains that the incident was resolved in compliance with regulations, the resurfacing of old data underscores persistent risks, including the reuse of sensitive information by malicious actors. The case follows a similar breach at Basic-Fit in April, where 400,000 members’ personal and financial data was exposed. Both incidents highlight vulnerabilities in the fitness sector, particularly around the handling of customer records and the long-term risks of data exposure, even when initial breaches are addressed. Synergym, founded in 2013 in Málaga, operates over 160 clubs across Spain.