PayAsUGym Data Breach (2016): What Was Exposed & What To Do

In December 2016, PayAsUGym suffered a breach that exposed personal information of more than 400,000 customers. The data later appeared in public leaks and circulated on Twitter. Passwords were stored as unsalted MD5 hashes. This incident occurred at a time when many online service providers were still relying on outdated hashing methods and when customer databases were frequent targets for bulk data theft.

Inside the incident

Public reports from December 15, 2016, stated that an attacker had accessed the PayAsUGym website and obtained records covering more than 400,000 customers. The exposed material included email addresses, names, phone numbers, IP addresses, browser user-agent strings, website activity logs, partial credit-card data, and passwords stored as unsalted MD5 hashes. The data set was subsequently posted publicly and shared via Twitter.

No further technical details on the intrusion method, the duration of access, or the precise volume of records have been disclosed in available reporting.

How a breach like this happens

Incidents involving customer databases often begin with the exploitation of web-application vulnerabilities, weak authentication controls, or compromised administrative credentials. Once inside, an attacker can query or export tables containing user records. When passwords are protected only by unsalted MD5 hashes, they can be subjected to offline cracking at scale using widely available tools and pre-computed tables.

After extraction, the material may be offered for sale, published on leak sites, or distributed through social-media channels, increasing the chance that the data will be reused in subsequent attacks such as credential-stuffing campaigns.

Who is PayAsUGym?

PayAsUGym operated an online platform that allowed users to purchase pay-as-you-go access to gyms and fitness facilities. Like other consumer-facing services in the fitness sector, the company collected names, contact details, and payment information to manage memberships and process transactions.

A breach at such an organization is consequential because the records typically combine identifiable personal data with credentials that can be tested against other online accounts.

What data was at risk

The breach notification and subsequent reporting identified the following categories of information as present in the leaked data set:

• Browser user agent details
• Email addresses
• IP addresses
• Names
• Partial credit card data
• Passwords (MD5, unsalted)
• Phone numbers
• Website activity

Exact field contents and the completeness of each record remain unconfirmed beyond these reported categories.

What's at stake

Individuals whose records were exposed face the possibility that their email addresses and cracked passwords could be used to access other online services where the same credentials were reused. Partial payment data and phone numbers can contribute to targeted phishing or account-recovery abuse.

For the organization, the incident created operational, regulatory, and reputational consequences typical of large-scale customer-data disclosures in the consumer-services sector.

What to do if you're exposed

Change passwords on the affected account and any other service where the same password was used. Enable multi-factor authentication wherever available. Monitor financial accounts and credit reports for unusual activity.

Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.