FitnessKPI Data Exposure Linked to French Gym as Company Denies Platform Breach

FitnessKPI says a third party accessed a customer’s account using valid administrator credentials, rejecting claims that attackers breached its underlying systems. Files shared online appear to contain information relating to 1,848 members of Genae Écully, a gym near Lyon, France.

The FitnessKPI data exposure reportedly includes contact details, membership records, bookings and payment-related information. However, the company says the access remained within the permissions of one customer account.

That distinction challenges the claim of a wider platform intrusion while acknowledging that someone obtained access to customer information.

Company Says Access Came Through a Customer Account

A forum user calling themselves Syrv4x claimed to have extracted member data from FitnessKPI’s databases.

However, FitnessKPI says its investigation of access logs found no compromise of its database, servers or infrastructure. It also says the incident did not involve exploitation of a platform or API vulnerability.

Instead, according to the company, someone used a customer administrator’s username and password to sign in through the normal login process. That person then viewed information available to the account.

FitnessKPI says the incident did not expose other customers’ data or information beyond that account’s authorized scope. The available account does not explain how the third party obtained the credentials.

Shared Files Point to Genae Écully Members

An analysis of the shared files linked all profiles in the examined batch to Genae Écully. This supports the assessment that the incident involved one gym location.

FitnessKPI provides business intelligence and management tools for fitness businesses. Genae uses the platform to analyze member activity, including identifying customers who may cancel their subscriptions.

The exposed files reportedly contain several categories of information:

• Names, email addresses and phone numbers
• Ages, dates of birth, gender and postal codes
• Membership plans and contracts
• Bookings and other activity records
• Payment amounts, dates, statuses and outstanding balances

Together, these records could reveal both personal details and patterns in members’ gym attendance.

Payment Records Did Not Include Banking Details

Nearly 160,000 entries in the examined files relate to payments at Genae Écully. These are payment-related records, rather than evidence of 160,000 affected people.

The entries include invoice dates, payment dates, amounts and unpaid balances. However, the analysis did not identify exposed banking information.

FitnessKPI also says it does not collect or store members’ credit card numbers, CVV codes, IBANs or health information. According to the company, those categories therefore fall outside the data its platform manages.

Nevertheless, membership and billing histories can still provide sensitive context about individual customers.

Detailed Records Could Support Convincing Scams

The FitnessKPI data exposure could give criminals enough detail to impersonate the gym in targeted messages.

For example, a fraudulent email could reference a member’s actual subscription and payment history. Those accurate details could make an otherwise suspicious request appear legitimate.

Similarly, someone could use outstanding-balance records to create fake payment reminders. A message citing a genuine debt might persuade a recipient to follow fraudulent payment instructions.

These are potential consequences of the exposure. The available information does not establish that criminals have already used the records in phishing campaigns.