Glofox glofox.com Glofox data breach: what happened and what to do
In March 2020 the gym management software company Glofox had a data breach that exposed 2.3 million membership records: names, email addresses, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes.
View all 13,115 breaches- Breach date
- 27 Mar 2020
- Affected
- 2,330,735
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Glofox, an Irish gym management software company, had a data breach in March 2020. Have I Been Pwned (HIBP) counts 2.3 million membership records.
What happened
The Irish Times reported that Glofox was investigating a possible breach, and some gyms that use the platform warned their members. Some gyms said the entry point had been found and closed, and advised members to reset their passwords.
What was exposed
HIBP lists email addresses, names, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes. MD5 is weak, so many of those passwords can be cracked.
What it means for you
A date of birth doesn't change, so it stays useful to criminals for years, especially when it comes with a name and phone number. Expect phishing that pretends to be your gym. Reset your gym app password and any account that shares it.
How to check your exposure
Search your email address on Have I Been Pwned, which holds this dataset and lets you look up an address for free. If it appears, change the password on every account that shared it, including your gym's app, and treat unexpected messages about memberships or payments with suspicion.
What to do if you were in it
- 1
Change your password and turn on 2FA
Set a new, unique password for your gym app. If you used that password anywhere else, change it there too, and turn on two-factor login on your important accounts. A password manager makes unique passwords easy.
- 2
Expect phishing and text scams that mention the breach
Treat unexpected emails, calls and texts that use your name, phone number or address with suspicion. Don't click links in them. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, which is why the steps above matter.
Frequently asked
Was I affected by the Glofox breach?
Check your email on Have I Been Pwned. If Glofox is listed, you were in the data.
What was exposed?
Names, email addresses, phone numbers, genders, dates of birth and MD5-hashed passwords.
Should I change my password?
Yes, for your gym app and anywhere you reused that password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
