A threat actor is allegedly offering for sale data purportedly stolen from George Brown Sports Club (GB3), claiming the breach affects 688,193 member records and includes highly sensitive personal and financial information belonging to gym members and their families.
The listing, published on June 24, 2026, advertises what the actor describes as a May 2026 compromise of the California-based fitness chain. The dataset is being offered for an asking price of $8,000 and is reportedly limited to two buyers. The same threat actor was previously linked to another alleged breach covered by BreachNews involving Houston Orthopedic Practice, where sensitive patient information was also reportedly offered for sale.
Evidence includes signed membership documents
To support the claim, the threat actor shared multiple sample images allegedly taken from the compromised dataset. The documents appear to include completed GB3 membership agreements, Electronic Funds Transfer (EFT) authorization forms, freeze request forms, handwritten member signatures, and other internal paperwork.
BreachNews is not reproducing the unredacted documents because the samples contain personally identifiable information belonging to individuals.
According to the threat actor, the alleged dataset includes:
- Member names and membership types
- Residential addresses
- Email addresses
- Home and mobile telephone numbers
- Dates of birth
- Social Security numbers
- Electronic funds transfer authorization information
- Bank names
- Payment card information and expiration dates
- Family member information associated with couple and family memberships
- Member signatures and related receipts
The published sample documents appear consistent with those claims, although BreachNews could not independently verify the full scope or authenticity of the alleged dataset.
Threat actor alleges notification failures
The listing further claims George Brown Sports Club was aware of the alleged breach but failed to notify affected members or relevant authorities. The threat actor also alleges the compromised information includes records relating to minors enrolled under family memberships.
BreachNews could not independently verify those allegations, and no public evidence currently confirms when or how the purported compromise occurred.
Potential risks for affected members
If authentic, the alleged dataset could expose affected members to identity theft, financial fraud, phishing attacks, and account takeover attempts. The combination of identity information, financial account details, payment information, and handwritten signatures would significantly increase the potential impact compared to many typical customer database breaches.
The inclusion of family membership information could also expand the number of individuals potentially affected beyond primary account holders.
No public statement issued
At the time of publication, George Brown Sports Club had not issued any public statement regarding the alleged breach.
BreachNews will update this article if the company confirms an incident or provides additional information regarding the claims.
