Almeida Law Group is investigating a data breach at Harman Fitness. The breach occurred on September 4th, 2025 and was discovered on September 1st, 2026. If you were affected, contact Almeida Law Group.
About Harman Fitness
Harman Fitness is a multi-unit franchise operator and management company that operated approximately 22 Crunch Fitness gym locations across Southern California and Texas. Founded by Curtis and David Harman and based in Los Angeles, the company partnered with NBA player James Harden to open three Crunch Fitness locations in Texas in 2024. In May 2026, Fitness Ventures acquired all 22 of Harman Fitness’s locations. The Texas Attorney General filing lists a Baltimore, Maryland address for Harman Fitness, which may reflect a registered agent or affiliated entity rather than the company’s principal place of business.
What Happened?
Harman Fitness was listed in a Texas Attorney General data security breach report (record ID BR-0005403), published on October 6th, 2026. According to the filing, the breach occurred on September 4th, 2025 and was not discovered until September 1st, 2026 — a gap of nearly twelve months. Harman Fitness notified affected consumers by U.S. Mail. The breach exposed a broad range of sensitive information, including names, addresses, Social Security numbers, driver’s license numbers, other government-issued ID numbers, financial account information, medical information, health insurance information, and dates of birth. A total of 4,714 individuals were affected.
The ransomware group NETRUNNER claimed responsibility for a Harman Fitness compromise on April 3rd, 2026 — approximately seven months after the reported breach date and roughly five months before the company says it discovered the breach. RedPacket Security has noted that NETRUNNER listings have included unverified or fabricated victim claims, and Harman Fitness has not publicly confirmed a ransomware attack; the Texas Attorney General filing is the only company-side disclosure found. It is unclear whether the NETRUNNER claim relates to the September 2025 breach or a separate incident, and whether the group’s April 2026 public posting should have prompted earlier detection. Separately, the law firm Ahdoot & Wolfson has announced it is investigating a possible class action lawsuit against Crunch Fitness operated by Harman Franchises following reports of the alleged breach. No filed complaint was found in search results as of October 2026.
Key Facts at a Glance
- Company or Organization: Harman Fitness
- Industry: Fitness / Health Club Franchise Operator (Consumer Services)
- Location: Baltimore, Maryland 21231 (per TX AG filing; principal operations in Los Angeles, California and Texas)
- Incident type: Unauthorized access / possible ransomware attack
- Date of breach: September 4th, 2025
- Date breach discovered: September 1st, 2026
- Date of consumer notification: October 6th, 2026 (date published at OAG website)
- Total persons affected: 4,714
- Litigation status: Ahdoot & Wolfson PC announced an investigation into a possible class action; no filed complaint found as of October 2026
- Source: Texas Attorney General data security breach report (BR-0005403); RedPacket Security – NETRUNNER / Harman Fitness; Ahdoot & Wolfson – Crunch Fitness (Harman Franchises) investigation; Franchise Times – Fitness Ventures acquisition
What Should You Do?
If you received a notice from Harman Fitness, take steps now to protect yourself. Enroll in any identity theft protection offered if you have not already done so, and be sure to note any enrollment deadline in your notice letter. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for someone to open new accounts in your name. Review your credit reports for unfamiliar accounts or activity at AnnualCreditReport.com. Because medical information and health insurance information were among the exposed data types, also review your Explanation of Benefits statements and request copies of your medical records to check for services you did not receive. Report any suspected fraud or identity theft to the Federal Trade Commission at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
