What the Partnered Health Cyber Attack Means for Fitness Operators

For personal trainers, Pilates instructors, yoga teachers, exercise professionals and gym operators, client data can feel like a background administration task. In practice, it is part of the trust relationship. A client may share details about surgery, chronic conditions, medication, pregnancy, mental health, rehabilitation goals or previous injuries so that a session can be delivered safely. If that information is mishandled, lost or accessed by an unauthorised party, the damage may extend well beyond embarrassment. It can create regulatory, reputational and financial consequences.

The broader environment is also becoming less forgiving. The Office of the Australian Information Commissioner reported a record 1,205 data breach notifications for the 2025 calendar year, with health service providers the most commonly affected sector. Recent privacy law changes have also strengthened enforcement options and introduced greater consequences for poor handling of personal information. Fitness businesses may not all operate under the same framework as medical clinics, but many still hold sensitive information that clients expect to be protected.

This is where risk management and insurance need to work together. Public liability and professional indemnity remain core forms of protection for many fitness professionals, but they do not automatically solve cyber exposure. A cyber incident may involve notification costs, forensic IT support, legal advice, business interruption, reputational repair and third-party claims. Those costs can be significant even for a small studio or sole trader.

Some considerations may include limiting the data you collect, storing client records securely, using strong authentication, keeping software updated, restricting staff access, checking booking and payment platforms, and having a clear breach response plan. If you use contractors, apps or outsourced administration support, review who can access client information and what happens if their systems fail.

The Partnered Health incident is a timely reminder that digital risk is now part of everyday fitness business management. Reviewing cover and speaking with a broker or adviser may help clarify whether your current insurance programme reflects the information you collect and the way your business actually operates.