Climb Up: hacker claims 151,000 climbing gym customer records

On October 14, a hacker calling themselves “Alduin” put up for sale, on a forum frequented by cybercriminals, a database they attribute to Climb Up, a French network of climbing gyms. They claim about 151,000 customer records from 29 facilities, covering January 2016 to March 2026. At the time of writing, Climb Up had not commented publicly. This is therefore an unconfirmed claim.

What the file reportedly contains

According to the listing, relayed by the breach-tracking sites FrenchBreaches, Fuites Infos and Cyberattaque.org, the roughly 94 MB file reportedly contains, for each customer: name, date of birth, email address, phone number, postal address, home gym and online account. It would also include the family ties declared between customers (parent, child, sibling, spouse). The seller says they are limiting the sale to two buyers.

They released a sample of about 1,000 records. Fuites Infos and Cyberattaque.org found customers from 13 gyms in it, under the Climb Up brand but also MROC and, according to Cyberattaque.org, SOLO Escalade. Minors appear in it, mainly through the family ties. The two sites found neither passwords nor payment data in the sample.

Caution on the numbers

The figure of 151,000 comes from the seller. The same customer may appear several times, so 151,000 records do not necessarily mean 151,000 people. The origin of the leak remains unknown. Cyberattaque.org notes that the records from several gyms share the same format, which could point to a common customer management tool. Nothing confirms this so far.

What to do

• Be wary of emails, text messages or calls in the name of Climb Up or a climbing gym (subscription renewal, booking, invoice, account update), especially if they ask for a payment.
• If in doubt, go through the official website or contact the gym's front desk directly.
• Parents: warn registered children and teenagers, who could receive targeted messages (camps, registrations, parental authorizations).
• As a precaution, change the online account password if it is used elsewhere too.