Data breach reference · November 2019

The GoodLife Fitness data breach

What was disclosed and how to check whether your address was in it.

At a glance
Disclosed
15 November 2019
Records
22,000 (Office of the Privacy Commissioner of Canada)
Type
Data theft / device loss
Sector
General

Check whether your address was in it

No account needed. The address is used only to run the check. Privacy

This disclosure

What is on the record.

22,000
Records reported in the disclosure
2,544 days
Since the disclosure, 15 Nov 2019

Source: Office of the Privacy Commissioner of Canada, as recorded in the LeakTrace tracker.

What happened

GoodLife Fitness reported a data-security incident affecting personal information of approximately 22,000 current and former employees. Records potentially exposed included names, dates of birth, Social Insurance Numbers, and direct-deposit banking details.

GoodLife notified affected employees and offered credit-monitoring services. The incident was reported to federal and provincial privacy authorities.

Reported impact: Credit monitoring provided to affected employees

Source: Office of the Privacy Commissioner of Canada, 15 Nov 2019.

What to do if you were affected

  1. If you are a current or former GoodLife employee, place a fraud alert on your credit file.
  2. Enroll in the credit monitoring GoodLife offered if you have not already.
  3. Consider a credit freeze via Equifax and TransUnion.
  4. Monitor your bank account for unauthorized transactions.
  5. Change passwords on any account tied to your GoodLife work email.

Common questions

When was the GoodLife Fitness breach disclosed?
In November 2019. Public reporting was carried by Office of the Privacy Commissioner of Canada.
How many people were affected?
22,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with GoodLife Fitness at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it and not reusing it, closes that door.

Other breaches in this sector

ConduentOct 2026 · 62,000,000 recordsDodo PizzaSep 2026 · 68,000,000 recordsTicketmasterMay 2024 · 560,000,000 recordsLondon DrugsApr 2024 · 3,000,000 records

Is your address in a public breach? Check my address →