HackingOtherRetailCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Harman Fitness

bd_f333be0622720281 · schema v1 · pii pii-v2

Severity

Medium

Discovered

—

Filed

Oct 6, 2026

To disclose

—

Affected

Not disclosed

Linked

3 records

Confidence

68%

Full breach record for Harman Fitness →

Harman Fitness experienced a data security incident on September 4, 2025, involving unauthorized access to its network. The incident potentially exposed personal information including names, Social Security numbers, driver's license or state-issued ID numbers, passport numbers, health information, and financial information including bank account and routing numbers. Financial passwords and banking passwords were not involved. Harman engaged external cybersecurity professionals to investigate. The company is offering complimentary credit monitoring services through Experian IdentityWorks to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Sep 4, 2025

Begins

Oct 6, 2026

Filed

This filing is one of 3 records about the same incident.View merged incident

A leak claim by netrunner about this victim was first seen 186 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitenetrunnerbd_65f21fe01cdc07102026-04-03 · +185dVerified

Regulatory filings (1) · sorted by filing gap

Texas State AGbd_bba7aa4fdcbb644e2026-10-06Candidate

Name: Harman Fitness
norm: harman fitness
Domain: crunchfitness.com

Name: Harman Fitness
norm: harman fitness
Domain: crunchfitness.com
Industry: Otherllm

Discovered: —
Breach occurred: Sep 4, 2025
Materiality determined: —
Notification sent: Oct 5, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Took steps to ensure the security of our systems
Commenced a prompt and thorough investigation
Worked very closely with external cybersecurity professionals experienced in handling these types of situations to assist us in determining the full extent of the incident and the scope of any data impacted
Providing you with access to Experian IdentityWorksSM
Set up a dedicated and confidential toll-free response line that we have set up to respond to questions at [REDACTED-PHONE]
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180dCA AG copy ≤15d · 1d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Consumers notified: Oct 5, 2026
→ AG copy submitted: Oct 6, 2026
1d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Consumers notified: Oct 5, 2026 → AG copy submitted: Oct 6, 2026	1d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Texas State AGOct 6 · first

California State AGOct 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-630881
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2026
Raw hash: 4363e0e450f34ba63f2cd7d4d4b79b247bd9eddf9d627e964be4af3b10c83b3e

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityHarman Fitness

Victim entityHarman Fitness

IncidentUnauthorized Access

Stated responseTook steps to ensure the security of our systems

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov