UK's Total Fitness exposed nearly 500K images of members, staff through unprotected database

A cybersecurity researcher discovered an unsecured 47.7GB database belonging to Total Fitness that contained approximately 474,000 images of members and staff, including some identity documents, payment card details, phone numbers and other potentially sensitive material. Total Fitness says most images were non-PII and a small subset of 114 images with identifiable information were removed; the company has secured the database and notified the UK Information Commissioner's Office. The researcher warned of privacy risks and potential abuse such as deepfakes, identity theft, and romance scams, although there is no evidence in the report of unauthorized access prior to the disclosure.