The Nordic fitness operator SATS Group said it detected unauthorised access to parts of its IT systems linked to its Elixia gym chain, with the incident first identified on 14 March.
The company informed customers on Tuesday and said it is treating the event as a cyber attack while an investigation continues with external security experts and authorities.
The breach affects systems within the group’s IT environment, though the company said there is no indication that its membership system has been compromised.
That system holds personal details and payment data of users across its network.
“We have detected unauthorised access to part of our IT environment and are investigating the matter as a cyber attack,” the company said in a statement sent to customers. It added that it has taken steps to strengthen security measures.
The SATS Group operates fitness brands including Elixia, SATS, Fresh Fitness, SATS Yoga and Balance.
The company said it has reported the incident to authorities and is working with cybersecurity specialists to determine the scope and nature of the breach. Initial findings suggest the situation is broader than first assessed.
Customers were told they can continue to use services as normal while the investigation proceeds.
HT