Luxury spas in Ontario hit by data breach, customers report fraudulent charges

An image of Thermea Spa Village in Whitby, Ont. (Thermea spa village Whitby/Facebook)

Groupe Nordik, a spa and wellness company headquartered in Chelsea, Que., is reporting a recent data breach of their gift certificate system.

In a letter to affected customers, Nordik said they became aware of “suspicious activity” on the system in late February. Nordik owns a number of spa locations across Canada, including Thermea Spa Village in Whitby, Ont., which last fall was found to be at the centre of a $5 million lawsuit claiming widespread staph infections obtained from a saltwater pool.

“It is possible that your personal information was accessible when purchasing a gift certificate on the platform during the period of Nov. 4, 2022 to Feb. 27, 2023,” reads the email to affected customers, signed by Alexandre Cantin, COO of Groupe Nordik.

Compromised information for those impacted by the leak includes full names, phone numbers, street addresses, and credit card information.

In the letter, Nordik said they will work with third-party experts to continuously strengthen security measures and “maximize the protection of […] clients’ data.”

“Please rest assured that we have done and are doing everything we can to rectify the situation,” the letter reads.

In a statement to CP24, a representative for Groupe Nordik said “it is unfortunate that data breaches are commonplace today.”

“We have asked our customers to stay vigilant and report any suspicious activity to local authorities,” the representative said in the statement.

Victims of the data breach have taken to social media, sharing fraudulent charges for hundreds of dollars in Uber and meal delivery app orders. One woman, Esha Harish in Ottawa, told CP24 she received several fraudulent DoorDash charges for over $100 each after purchasing a Nordik gift card as a Christmas present.

“They didn’t really offer anything,” she said. “They didn’t offer a discount or services, or any credit monitoring or anything. They just told us, ‘you’re on your own.’” Harish said the fraudulent charges occurred around Christmastime, adding a frustrating hitch to holiday retail shopping.

“This was kind of a huge nuisance.”