The Incorpore Breach Put Gym Directory Data for 2,999 UK Users at Risk

HEROIC analysts identified this breach affecting Incorpore, a UK gym directory site, tracing back to an original compromise dated January 1, 2016. The confirmed breach covers 2,999 accounts, and the passwords were stored in plaintext, meaning no cracking was required to use them.

Why This Is Dangerous

Directory and listing sites like Incorpore are easy to overlook as a security risk, but a gym directory account still ties a real email address to a real password. Because these passwords were never hashed at all, anyone who obtained this data had immediate, ready-to-use credentials, no cracking tools or time investment required.

What Was Exposed

• Account credentials stored in plaintext
• Associated usernames tied to the Incorpore platform

The original breach record did not list additional data fields beyond account credentials, so HEROIC is reporting only what has been confirmed.

Why This Matters

This breach is a reminder that industry doesn't determine risk, password reuse does. A directory site for gyms may seem low-stakes, but if the same password protects an email account or a banking login elsewhere, the exposure is just as serious as a breach at a major company. Plaintext storage makes that risk immediate rather than theoretical.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to the site's backend rather than targeting individual users. This typically results from an unpatched vulnerability, SQL injection, or a stolen administrator credential. Once inside, the full user table was exported, and because it required no cracking, the data was exploitable the moment it was stolen.

Check If You Are Affected

Don't leave it to chance. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this Incorpore breach, and tells you instantly if you were exposed. Run a free scan now.