Forus Deporte y Ocio · Breach

[Single source] Black X claims data on 867,800 Forus fitness customers

Nov 09, 2026 · 1 min read

Extortion group Black X listed Forus Deporte y Ocio, an operator of 60+ sports and fitness centres in Spain, Italy and Portugal, claiming a complete dataset on 867,800 customers with names, national ID numbers, birth dates, emails, phone numbers and bank account details. Forus has not confirmed an incident and no samples have been independently verified.

By HIFY Radar newsroom Updated 11/09/2026 02:21 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

The extortion group Black X has listed Forus Deporte y Ocio (forus.es), a Madrid-based operator of more than 60 sports and fitness centres in Spain, Italy and Portugal, on its leak site. The group claims to hold a "complete dataset" on 867,800 customers, including names, national ID numbers, birth dates, emails, phone numbers and bank account details.

Observed

Forus has not confirmed any incident, and no data samples have been independently verified. Security analysts advise treating this as an unverified threat-actor claim, not as confirmation of a breach.

What happened

Alleged

The Black X extortion group added Forus Deporte y Ocio, which operates over 60 sports and fitness centres across Spain, Italy and Portugal from its base in Madrid, to its leak site. Leak-site listings of this kind are typically used to pressure victims into paying an extortion demand.

Alleged

According to the listing, the stolen material is a "complete dataset" covering 867,800 customers. The claimed fields include full names, Spanish national ID numbers, dates of birth, email addresses, phone numbers and bank account details.

Why it matters

Inferred

If the data is genuine, the combination of national ID numbers and bank account details would enable direct-debit fraud, identity theft and highly convincing phishing emails that reference gym memberships, because attackers would know real customer identifiers.

Inferred

Many Forus centres are run under contract for city councils, so users of municipal sports facilities: not just private gym members: could be among the affected individuals, widening the potential impact to local-government service users.

What to do

Inferred

Forus customers, including users of council-run sports centres, should monitor bank statements and direct debits for unauthorised charges, be suspicious of emails or calls referencing their membership or asking for ID or banking details, and avoid clicking links in unexpected membership-related messages.

Observed

Analysts and organisations tracking this incident should treat the listing as an unverified threat-actor claim rather than confirmation of a breach, and wait for independently verified data samples or a statement from Forus before attributing or quantifying any breach.

Confirmed and still uncertain

Observed

What is claimed: Black X listed Forus on its leak site, asserting a complete dataset on 867,800 customers with identity and banking fields. What is observed: a public report of that listing by a dark-web monitoring account dated 9 November 2026.

Observed

What remains unknown: whether the breach actually occurred, whether the data is genuine and current, how it was obtained, and whether any ransom demand or deadline has been made. Forus has not confirmed an incident and no samples have been independently verified.

What people are saying

Observed

DailyDarkWeb, a dark-web monitoring account on X, reported the listing and flagged that the claimed data mix would enable direct-debit fraud, identity theft and convincing gym-membership phishing if real, explicitly urging readers to treat it as an unverified threat-actor claim.

Observed

Forus Deporte y Ocio has said nothing publicly: the company has not confirmed an incident, and no statement, denial or comment from the organisation appears in the available evidence.

Evolution

Observed

The listing is a fresh development first reported on 9 November 2026. As of this report, there are no subsequent developments in the evidence batch: no Forus confirmation or denial, no published data samples, no verification by researchers and no reported extortion deadline.

Reach

Observed

1 independent groups, 1 updates, and 1 engagements.

Technical detail

Inferred

The claimed dataset combines personally identifiable information (names, national ID numbers, birth dates, emails, phone numbers) with financial data (bank account details). That pairing is what makes direct-debit fraud feasible: an attacker with a victim's identity details and account information could set up or manipulate recurring payments.

Observed

No technical details about the intrusion itself: initial access vector, malware, timing or affected systems: have been disclosed; only the leak-site listing and the actor's description of the data are available.

Sources and evidence

Observed

This story rests on a single source: a post by DailyDarkWeb on X (9 November 2026) reporting the Black X leak-site listing for Forus, the claimed 867,800-record dataset and the absence of confirmation or verified samples.

Inferred

Evidence limitations: the listing itself has not been independently reviewed in this batch, no data samples have been verified by third parties, and there is no statement from Forus or law enforcement. Confidence in the breach actually having occurred is correspondingly low.