WELLINGTON, NEW ZEALAND / RankWire.AI / – The increasing use of fitness tracking apps and social media platforms has inadvertently exposed sensitive location data, raising potential security issues. Recently, detailed workout information linked to military sites has come to light, highlighting vulnerabilities in public activity sharing. In particular, a review uncovered that hundreds of individuals have recorded their exercise routines at New Zealand Defence Force facilities and made some of this data publicly accessible. Since January, 565 Strava users have logged workouts at NZDF bases and camps, with 488 of those accounts featuring visible activity histories on public profiles. Investigators could not confirm that each account belonged to military personnel, but most contained details suggesting links to military service.
These workout records spanned several key defense locations across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also uploaded activities from Papakura Military Camp and the nearby Ardmore training area. The public segments on Strava displayed routes within or around military facilities, with some segments named after military fitness tests or landmarks. Additionally, several leaderboards had displayed participant names for years, further highlighting the exposure of personal data.
Beyond domestic sites, activity logs revealed international military locations in 13 countries and territories. These included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Some accounts also showed repeated travel between New Zealand bases and overseas military installations, creating visible timelines that linked individuals to specific locations.
Public Profiles Unveil Travel and Training Patterns
Strava utilizes GPS data to log activities such as running, cycling, and walking, and its public segments rank users who complete the same routes. The review identified 41 public segments at defense sites. Even users with limited profile privacy settings sometimes appeared by name on segment leaderboards, enabling activity connections across various military locations in at least 30 cases. Additionally, tagged workouts and linked accounts have, in 13 instances, revealed family relationships.
Many public profiles included more than just route information. Users uploaded workout titles, images, and videos connected to training areas and military facilities. Several profiles showed activity around Waiouru and other defense sites. One senior NZDF member used their real name while in the United States, with activity near multiple military bases, including runs close to New Zealand’s embassy in Washington.
NZ Defense Department Issues Location Data Security Advice
The New Zealand Defence Force has issued guidance warning about the risks associated with fitness apps and social media sharing. Personnel are advised to disable fitness tracking features at sensitive locations and avoid using full names on these platforms. NZDF states that it also provides ongoing operational security guidance prior to deployments and other activities, along with measures to protect personnel, facilities, operations, and information. Nonetheless, the organization does not have a specific policy written exclusively for Strava or other fitness-tracking applications.
Strava offers several privacy controls, such as limiting activity visibility to followers, making activities private, or hiding parts of activity maps. Users can also hide entire activities from public view. Strava recommends that individuals use these enhanced privacy settings, especially near workplaces and sensitive sites. Activities set to followers-only or private are excluded from public segment leaderboards. The NZDF emphasizes that online fitness data does not necessarily constitute a security breach, but highlights the importance of responsible sharing.