Colruyt Group has confirmed that an unauthorised third party got into the member management system of Jims, its Belgian fitness chain, and copied personal data on about 150,000 members and prospective customers. The breach happened between 13 and 20 July 2026. At first the company said only "a limited group of customers" was affected. Two months later, and a week after a leak listing appeared on an underground forum, Colruyt admitted the true scale, according to VRT NWS. Every figure below comes from press reporting or from Colruyt statements quoted in that reporting. All of it gives 150,000 as the record count, but attributes it differently. VRT NWS and Tweakers present it as Colruyt's confirmed figure. Sudinfo/Belga and Nieuwsblad trace it to the attacker's own claim, as documented by FrenchBreaches. Colruyt's own statements, as quoted, describe the scope as members linked to "up to 31" of Jims' 85 Belgian clubs.
What Happened
- 13 to 20 July: According to Colruyt's account as reported by VRT NWS, a "malicious party" downloaded customer data during this window. HLN dates the start of the breach to 13 July.
- Late July: A Jims member in Brussels received a suspicious email that claimed to come from the chain and reported it, VRT NWS says. Jims then sent all customers a general warning that "fake emails are circulating" and told them not to share personal or banking details through email links. The warning did not mention a breach. Weeks later, and only after the member pushed for answers, the company said the phishing came from a data leak affecting a "limited group of customers." Colruyt said the affected accounts had been reset and given extra security, and that it had the phishing email addresses and domains blocked. It has not explained what the account resets involved (Tweakers).
- 22 September: FrenchBreaches reported a listing on a data-leak forum that claimed to hold a JIMS database ("User: 150k") and included a sample of 1,000 records. FrenchBreaches rated the claim credible but not independently confirmed. Undercode News covered the listing on 23 September and explicitly called it an unverified threat-actor claim.
- 29 September: Colruyt confirmed the breach to VRT NWS, HLN, Belga and others and began emailing affected members. HLN says the story also reached it through a reader tip line. Spokesperson Hanne Poppe said the Belgian Data Protection Authority (GBA/APD) was notified "within the applicable timeframes" and that a formal police complaint had been filed. A GBA spokesperson, Aurélie Waeterinckx, confirmed to Nieuwsblad that the authority had been informed.
Colruyt says only Jims systems were affected, not other Colruyt Group systems. According to Sudinfo/Belga, the recently acquired clubs and the Jims clubs in Luxembourg were also not affected. Colruyt has not said which 31 clubs are involved (Tweakers).
The account of when the company understood the scale is inconsistent. Colruyt says it notified the regulator on time. But its public messaging moved from "limited group" in the summer to about 150,000 only after the dataset was advertised online. The sources do not show whether Colruyt knew the full scope earlier than it said publicly.
What Was Taken
Colruyt's list of affected data, repeated across VRT NWS, HLN, Sudinfo and Nieuwsblad:
- Full names
- Postal addresses
- Dates of birth
- Email addresses
- Membership details
- IBAN bank account numbers, in some cases
Colruyt says no passwords or health data were exposed.
The attacker's sample may contain more than Colruyt has acknowledged. FrenchBreaches says the 1,000-record sample also includes phone numbers, customer IDs and BIC codes alongside IBANs, and Undercode News reports much the same field list. Colruyt's public statements do not mention phone numbers. This is based only on secondary reporting of an attacker's sample, so treat it as unconfirmed. Still, members should assume phone-based fraud is possible, and Colruyt itself warns about phone scams. FrenchBreaches adds that the number of records containing IBANs has not been independently established.
The data is already being offered for sale on the dark web, according to VRT NWS, HLN and Tweakers.
Why It Matters
- Ready-made fraud kit. A name, address, date of birth, email and IBAN, linked to a known recurring payment relationship, is exactly what convincing payment-diversion and direct-debit scams need. Colruyt's own notice tells members to watch for messages about membership, payments, refunds, account changes and direct debits (Tweakers). The data has already been used for phishing: members received fake Jims emails in July, before most of them knew there had been a breach.
- Phishing was the first sign. The earliest outside signal was a customer reporting a phishing email, not the company's own detection. The first public response dealt with the phishing and left the breach undisclosed. Organisations should treat a sudden brand-impersonation campaign aimed at their own customers as a possible sign of a data compromise.
- Scoping failure. The jump from "limited group" to 150,000 records at 31 clubs shows how early scope estimates go wrong when exfiltration logging is incomplete. Revising disclosures only after a leak is advertised costs trust and may draw regulatory scrutiny.
- Part of a sector pattern. Sudinfo notes recent incidents at Belgian sports bodies, including the table-tennis and gymnastics federations. Membership-driven leisure organisations hold banking data but often lack enterprise-grade security.
The Attack Technique
No threat actor has been named, and there is no public attribution. Colruyt says only that an unauthorised third party gained access to "parts of the member and customer management system" and consulted and copied personal data (HLN, Nieuwsblad). The initial access vector is not known. The sources do not say whether it involved stolen credentials, a vulnerable application, or a third-party SaaS or CRM platform.
Two details suggest a direction but prove nothing. Colruyt said affected accounts were reset, which could point to compromised user or admin credentials. And the breach was limited to a subset of clubs and excluded recently acquired sites, which could point to a segmented or per-region data store. Before Colruyt confirmed the breach, Undercode News suggested the data might come from an older CRM export or a third-party system. Colruyt has since confirmed the breach happened in Jims' own member management system, so that theory is largely superseded. The monetisation pattern is typical of financially motivated data brokers rather than ransomware: a forum listing with a free sample, followed by a sale.
What Organizations Should Do
- Monitor for impersonation of your brand. Watch for lookalike domains and phishing campaigns aimed at your customers. When customers report one, run a compromise investigation, not just a takedown.
- Log and alert on bulk exports from member or CRM systems. Enable audit logging for record downloads and API pulls, and alert on unusual volumes, so the scope of exfiltration can be measured instead of estimated.
- Harden access to customer databases. Require phishing-resistant MFA for every admin and staff account on member management platforms, including vendor and franchise-level accounts. Review who can export full records.
- Minimise and segment payment data. Tokenise or separately store IBAN/BIC data used for direct debits, and restrict which roles and systems can see it in plain text.
- Disclose once, accurately. Wait until you have measured the scope before you publish a figure. If the scope grows, say so proactively rather than after a dark-web listing forces the issue.
- Give affected customers specific guidance. Tell them which channels you will never use to request payment details, remind them how to dispute unauthorised SEPA direct debits, and warn them explicitly about email, SMS and phone pretexts that use their membership data.
Sources: Data breach at Colruyt’s Jims fitness chain much larger than though... | Datalek bij Colruyts fitnessketen Jims: gegevens van 150.000 leden... | La chaîne de salles de sport Jims victime d’une cyberattaque : les... | Datalek bij Colruyts fitnessketen Jims veel groter dan gedacht: geg... | Hackers bieden gegevens van 150.000 leden fitnessketen Jims aan op... | JIMS piraté : les données de 150 000 adhérents de salles de sport... | “Naam, adres, e-mailadres... werden online aangeboden”: gegevens va... | JIMS Fitness Data Leak Claim: 150,000 Belgian Customers Allegedly E...