Total Fitness Data Breach

THIS ACTION IS NOW CLOSED

In January 2021, Total Fitness emailed its customers to let them know that it has fallen victim to a cyberattack. This page explains how the Total Fitness data breach happened.

What happened in the Total Fitness data breach?

In February 2021, Total Fitness emailed its customers to let them know that it has fallen victim to a cyberattack.

As a result of the attack, personal data was breached, including bank account information.

Usernames, passwords, and credit card information were not compromised. However, a scanned copy of customer membership agreements was taken. These agreements included member address details and bank account information. The information went back as far as June 2018.

As information stolen in breaches is often used by cybercriminals, victims of the Total Fitness data breach were vulnerable to cyber fraud and scams.

Total Fitness attempted to reassure its customers that “it is extremely unlikely that this data could be exploited in such a way that would lead to any financial loss”. But unfortunately, our data breach solicitors do not believe that Total Fitness could say this with any confidence. We have seen first-hand the damage that can be done when hackers get access to such personal and sensitive data.

Similar data breaches have resulted in fraud, blackmail, and identity theft, so victims of this breach were at high risk of being targeted by cybercriminals.

Total Fitness data breach timeline

24 January 2021

Total Fitness emailed its customers to let them know that it has fallen victim to a cyberattack. As a result of the attack the personal data of Total Fitness members was breached, including bank account information.

Your questions answered

See our answers to the FAQs we get asked about the Total Fitness Data Breach.

How did the security incident happen?

According to Total Fitness, its IT systems were “attacked by a highly sophisticated international organised cyber-crime network”. As a result of the attack, personal data has been breached, including bank account information

What data was accessed?

A scanned copy of customer membership agreements may have been taken. These included member address details and bank account information. Usernames, passwords, and credit card information were not compromised.

Was my information accessed in the breach?

If your data was involved in the data breach, then Total Fitness should have emailed you to inform you of the situation.

Were Total Fitness members at risk following the data breach?

Total Fitness attempted to reassure its customers that “it is extremely unlikely that this data could be exploited in such a way that would lead to any financial loss”. But we have seen first-hand the damage that can be done when hackers get access to such personal and sensitive data.

Total Fitness did recommend that members take the following steps following the data breach:

Check your bank statement regularly for any unusual payments that you don’t recognise.
Use strong passwords and change them regularly. Try to keep them at least eight characters long and use numbers, upper case, lower case and symbols.
Never give out personal details over the phone unless you’re sure who you’re speaking to.
Check your Credit Report regularly for newly opened accounts or credit searches that you don’t recognise.
If you think you have been a victim of fraud you should report it to Action Fraud, the UK’s national fraud and internet crime reporting centre, on 0300 123 2040.

Total Fitness also offered a free 12 Month subscription to online monitoring service TrueIdentity to help keep victims of this breach safe.