Elite Fitness confirms DragonForce ransomware attack in New Zealand

Elite Fitness, a New Zealand retailer of gym and fitness equipment, confirmed that it was hit by a ransomware attack after the DragonForce gang listed the company on its dark web leak site. The retailer said it detected unusual activity from an unauthorized third party on one of its systems on the night of 26 June 2024.

DragonForce claimed the intrusion on 2 July 2024, saying it held 5.31 gigabytes of Elite Fitness data. The group followed through and published just under 10,000 files, according to Cyber Daily, which reviewed the leak.

The published material was dominated by routine business records such as invoices, receipts, and banking and credit card statements, along with product user guides and creditor documents. It also contained scans of passports, credit cards and driver licences, plus immigration paperwork and finance applications. Elite Fitness confirmed that both customers and staff were affected but did not publish a count of individuals or a full breakdown of the data types involved.

The company described the incident as a sophisticated cyber attack and said affected individuals had been contacted. It reported the matter to New Zealand's Computer Emergency Response Team and other government agencies. Its website remained offline while the response continued at the time of reporting.