Cooper Aerobics Network Targeted by Cyber Incident, 90k Exposures

Cooper Aerobics is a health and lifestyle entity concerned with providing comprehensive wellness solutions. As a business organization, their brand includes The Cooper Institute, a Clinic, a Fitness Center, a Spa, a Vitamin line, Wellness Strategies, and a Hotel. Cooper Aerobics has served its clients since 1970; they’ve developed fitness ideals that have become a staple in the wellness of active adults worldwide and garnered a range of attention, from celebrity endorsements to individual condemnation. In February 2023, an unauthorized actor accessed Cooper’s network—exposing the information of 89,399 clients and patients. 

How Did the Attack Occur? 

Cooper Aerobics published a Notice of Breach on their website last week. According to it, the attack involved an unauthorized party accessing and removing data files from Cooper’s network. How the assailants achieved this is unclear; however, because Cooper officials only recently discovered the event, more information may become public as investigations conclude in 2024. 

What Information Was Viewed or Stolen? 

Despite ongoing investigations into the event, Cooper’s notice lists potentially breached data elements. The exposures may differ from one individual to another, but the risks of data misuse remain the same. 

The exposed elements may include names, contact information (including address, phone number, and email address), personally identifying information (including dates of birth, tax ID numbers, Social Security Numbers, driver’s licenses, government-issued IDs, and passport numbers), financial details (including account and routing numbers, payment card numbers, and expiration dates), personal medical data (including patient account numbers, medical records, providers, prescriptions, and procedures, health insurance carriers, health insurance member numbers, and group ID details), and the username and password of Cooper Aerobics user accounts.

How Did Cooper Aerobics Admit to the Breach? 

Based on the preliminary information published in the event notice, the unauthorized actor gained entry to Cooper’s network around February 3rd, 2023. The threat actor then removed files from the network and presumably left after. The breach remained undiscovered until months later, around December 8th. Upon learning of the event, officials opened investigations into its cause and consequences; the preliminary reviews concluded around January 5th, 2024—when officials began notifying impacted parties.

What Will Become of the Stolen Information? 

The data stolen in this event is extensive and a potentially dangerous loss for data owners; they could be victimized repeatedly depending on how the criminals used the data and their access to public services. Cybercriminals could use the data together in the same fraudulent act or use them at different periods; years could pass between data misuse cases. Consequently, those with data exposed in this event must act immediately—patients can still protect their data from misuse. 

What Should Affected Parties Do in the Aftermath of the Breach? 

Although the breach occurred nearly a year ago, victims must still take precautions with their data. In that time, the cybercriminals may have sold it to others or used it in other nefarious plots; subsequently, victims must take steps to protect themselves. They should start by check their account passwords and accessing permissions to their strictest settings. They should enable multi-factor authentications everywhere possible and consider ordering itemized account explanations from their institutions. Lastly, they may want to invest in medical monitoring services—allowing individuals peace of mind. Now that the information is compromised, there’s no way to conceal it; however, if individuals act immediately, they may be able to mitigate the consequences of this breach.