JIMS
CriticalConfirmedRetail
JIMS, a gym chain notably present in Belgium, confirmed in July 2026 that it had suffered a computer system intrusion, followed by a phishing campaign targeting its members with a fake payment-method update email. In September 2026, a post on a data-trading forum claimed possession of a database covering 150,000 members, with a 1,000-record sample containing names, dates of birth, addresses, emails, phone numbers, customer IDs and banking details (IBAN, BIC).
The exposed data (identity, contact details, IBAN) enables targeted phishing and banking fraud attempts, as already seen in the campaign targeting JIMS members.
- Disclosed on
- September 22, 2026
- Accounts affected
- 150,000
- Sector
- Retail
- Country
- Belgium
- Cause
- Undisclosed
Exposed data
- Email address
- Full name
- Phone number
- Postal address
- Date of birth
- Customer ID
- Banking data (IBAN, card)
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact