Hackers have stolen personal data from 150,000 members of the Jims fitness chain. Parent company Colruyt has confirmed the breach. The data theft dates back to this summer, but its true scale has only now become clear. The chain is now trying to warn all members about potential phishing messages.
Home News
Data breach at Colruyt’s Jims fitness chain much larger than thought
Colin Clapson
Published:
Initially, a “malicious party” was said to have been able to download customer data from “a limited group of customers” between 13 and 20 July.
The company added that the accounts affected had since been reset and given extra security measures. Colruyt also reportedly had the fraudulent email addresses and domain names used in the phishing attacks blocked.
Hack larger than anticipated
It is now the end of September, and Colruyt has reluctantly had to admit that it had underestimated the scale of the data breach. That “limited group of customers” turns out to consist of some 150,000 members from 31 of the 85 Jims fitness clubs in Belgium.
Their names, addresses, dates of birth, email addresses, membership details and, in certain cases, bank account numbers may have been stolen. The stolen data is already being offered for sale on the dark web. No passwords or health data have been leaked. Furthermore, data from other Colruyt systems is not believed to be affected.
“The Belgian Data Protection Authority was informed within the applicable timeframes, in accordance with legal obligations,” said Colruyt spokesperson Hanne Poppe. “We are also closely monitoring the situation with all parties involved, including the police, with whom we have lodged a formal complaint.”
Warning email on the way
Jims’ members are also due to receive an email today explaining the potential impact of the data breach. In it, Colruyt warns, amongst other things, about malicious emails or text messages.
“As the data in question was made available online, there is a risk that third parties may attempt to use it for fraudulent purposes, such as phishing via email, text message or telephone. As an active member of Jims, we advise you to be particularly vigilant regarding messages referring to your membership, payments, direct debits, refunds or changes to your account.”