Glofox Gym‑Management Platform Breaches 2.33 M Member Records, Exposing Personal Data and Unsalted MD5 Passwords
What Happened – In March 2020 the Irish SaaS provider Glofox disclosed that a breach exposed 2,330,735 member records. The data set included names, email addresses, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Weak credential storage (unsalted MD5) is a classic control‑gap that a continuous control‑assurance program should detect, document and remediate.
- The incident illustrates the need for verifiable evidence that access‑control policies (password hashing, MFA, least‑privilege) are enforced and regularly audited.
- Mapping this breach to the “protect credential integrity” control objective provides a single, framework‑agnostic trust signal across SOC 2, ISO 27001, NIST CSF and others.
Who Is Affected – Fitness‑industry SaaS providers and the millions of gym members whose personal data were compromised.
Recommended Actions
- Conduct an immediate password‑storage audit; replace unsalted MD5 hashes with salted, adaptive‑hash algorithms (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all administrative and user accounts.
- Map the credential‑integrity control to your audit framework, collect evidence of hashing standards, and log remediation steps in a continuous monitoring system.
Technical Notes – The breach appears to stem from a misconfiguration or inadequate security controls around credential storage rather than a known exploit. No specific CVE is cited. Exposed data types: DOB, email, gender, name, phone, password hash. Source: Have I Been Pwned – Glofox breach