The problem here isn’t much that #BasicFit has been hacked.
Today’s tech stacks are so complex and distributed over multiple systems that all IT products are always one S3 dump away or one token leak away from being hacked.
The problem is that a gym perhaps is not supposed to store all this information about their customers:
- Full name
- Date of birth
- Email
- Address
- Phone number
- Bank account details
If gyms could still operate fine 20 years ago without gathering all these details, then I don’t see why they need them now.
My full name and a customer ID should be more than enough to know who I am, for the purposes that the gym needs. And if payments are externalized to external payment processors, then there should also be no need to store bank details or credit card numbers.
The best way to mitigate the impact of data hacks is to not store the data you don’t need in the first place - even if you think that you can make an extra buck from it by selling it to data brokers.
At the very least, pick on the habit of using one-off email aliases, fake phone numbers and fake dates of birth when you know that that information is very unlikely to ever be needed.
https://www.bleepingcomputer.com/news/security/european-gym-giant-basic-fit-data-breach-affects-1-million-members/