On 23 April 2026, Cyberattaque.org documented a claimed sale of a database attributed to Bodyhit. The seller advertised more than 218,000 customers and over 42,000 banking records, including IBANs and BICs. These are claimed figures: the outlet explicitly says it has no official confirmation of the database’s authenticity or the origin of the data.
That distinction makes it possible to take precautions without treating the allegation as established fact. The IBAN guidance below draws on the CNIL; it does not establish that banking fraud occurred in the Bodyhit case.
What the report establishes
Cyberattaque.org’s case-specific report provides a date, context and the contents of the claim, including customer contact details and banking information. It does not establish that every member is affected or that passwords were stolen.
Ask Bodyhit about your situation through an official channel found independently of an alert message. The CNIL says the organisation responsible can answer such questions, and advises against websites that request personal details while claiming to check whether you appear in a leak.
What an IBAN really enables
An IBAN identifies a bank account for payment operations; it is not an online-banking login. The CNIL explains that it can nevertheless be used to attempt an illegitimate direct debit or impersonate another person’s IBAN when creating a mandate. A fraudster may also use personal details to make a fake call or phishing message seem credible.
The CNIL recommends monitoring transactions, checking the authorised creditors list in online banking and contacting the bank if anything is wrong. The updated Cybermalveillance.gouv.fr guidance on data breaches, updated on 1 October 2026, also advises notifying your bank if an IBAN appears in a breach, monitoring the account and reporting unauthorised direct debits. These general risks do not establish that they occurred in the Bodyhit case.
The extra risk from reused passwords
An IBAN cannot be used to attempt a login, but the email address used for membership may be tested with a password recovered from another breach. This is the domino effect: reusing one secret across a fitness service, email and a shopping account turns separate incidents into one access chain.
Priorities differ. Someone who reused the same secret should start with email, financial accounts and recovery services. Someone who already uses unique secrets should focus on monitoring payments and messages that repeat accurate membership details.
Examples of requests to verify include:
- a fake bank adviser asking you to approve a transaction “to cancel it”;
- a fake membership refund leading to a login page;
- a request to update bank details using a link or attachment;
- a text message using Bodyhit’s name to request a code or urgent confirmation.
These are examples of possible fraud after a data leak, not attacks attributed to Bodyhit by a verified source. The CNIL advises against clicking links in messages and recommends entering the official website address yourself; for a suspicious call, call the bank using the number on a statement. For comparison with a documented customer-account incident, read our article on Magasins U loyalty accounts and our guide to verifying a breach alert and prioritising password changes.
Action plan for a member
- Review the bank account and direct debits from recent weeks.
- Contact the bank if a verified notice identifies your IBAN or you find an unknown transaction.
- Change every reused password, starting with email and financial accounts.
- Enable multi-factor authentication and close unknown sessions.
- Keep suspicious texts, emails, caller numbers and website addresses.
- Report any unauthorised transaction and file a complaint if the data are misused.
There is no need to send a full bank statement, identity document or complete screenshot to someone who contacts you unexpectedly. Reports should contain only what is necessary and use the organisation’s official channel.
For teams and franchisees
Teams managing memberships should adopt a simple rule: never change bank details based on an email alone. Confirmation through the official account area or a second channel reduces the risk of a fraudulent bank-detail change.
They should also avoid forwarding a support link before checking its domain. An organised vault helps teams find the credentials they use, but protection also depends on closing sessions and securing recovery accounts.
The Soclyde connection
Soclyde does not monitor a bank account and does not replace Bodyhit or a bank during incident response. Its value is in preparation and remediation: create a unique secret for every service, organise access and keep it in a local encrypted vault. Targeted rotation is then possible without writing new secrets in a document or email.
Takeaway
An exposed IBAN is banking information to monitor, not a login key. The danger increases when it is paired with an email address and a reused password. Review direct debits, contact organisations through official details and treat password reuse as a priority.
Read more: create strong, unique passwords or talk to Soclyde.
