Glofox Data Breach (2020): What Was Exposed & What To Do

Inside the incident

Public records state that the breach affected 2.3 million membership records held by Glofox. The data types confirmed as exposed are dates of birth, email addresses, genders, names, phone numbers and passwords stored as unsalted MD5 hashes. No further details on the timing of access, the method of intrusion or the precise volume of records accessed beyond the reported total have been disclosed in available reporting.

How a breach like this happens

Incidents involving the exposure of customer records from service providers often begin with unauthorised access to internal systems or third-party connections. Attackers may exploit unpatched software, weak authentication controls or misconfigured storage to reach databases that contain user information. Once inside, data can be copied and later posted or sold. In many cases the exact entry point remains undisclosed by the affected organisation or investigators.

Who is Glofox?

Glofox supplies software used by fitness centres and gyms to manage memberships, class bookings and member communications. Companies in this sector routinely store personal details supplied during sign-up so that operators can contact members, verify identities and process renewals. A breach at such a provider therefore touches records belonging to individuals who may not have had a direct relationship with Glofox itself.

What was likely exposed

The breach record lists the following data elements as exposed: dates of birth, email addresses, genders, names, phone numbers and passwords stored as unsalted MD5 hashes. No additional categories of information have been confirmed. Organisations of this type commonly hold further details such as payment information or attendance histories, yet the exact contents of the 2.3 million records remain limited to the fields already named.

Why it matters

Names, email addresses and phone numbers can be used for targeted phishing or unwanted contact. Dates of birth and genders add to the profile that can be assembled about an individual. Passwords stored as unsalted MD5 hashes are comparatively weak; if reused elsewhere they may be recovered more easily than passwords protected by stronger methods. For the organisation, the incident creates legal, regulatory and operational obligations around notification and remediation.

What to do if you're exposed

Individuals can change passwords on any account that reuses the exposed credentials and enable multi-factor authentication where available. Monitoring email and phone accounts for unusual activity is advisable. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.