WELLINGTON, NEW ZEALAND / RankWire.AI / – Location information linked to hundreds of individuals using New Zealand Defence Force facilities has been exposed through public fitness activity tracking. An assessment identified 565 Strava users who logged workouts at NZDF bases and camps since January. Of these, 488 accounts maintained public profiles with visible workout histories. Investigators could not confirm that every account belonged to defence personnel, but most contained data suggesting a connection with military service.
Major defence locations across New Zealand showed activity, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also recorded exercises at Papakura Military Camp and the adjacent Ardmore training area. Public segments on Strava mapped routes within or around military facilities, with some segment names referencing fitness tests or landmarks associated with bases. For years, several leaderboards displayed participant names publicly.
The exposed records extended beyond New Zealand’s borders, with workout data logged at military sites across 13 countries and territories. Locations appeared in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Data also originated from Antarctica. Some accounts showed repeated travel between New Zealand military installations and overseas locations, creating accessible timelines that linked individuals to specific sites.
Public profiles reveal travel routes and training details
Strava records exercise activities such as running, cycling, and walking via GPS data. Its public segments allow ranking of users completing identical routes. The review uncovered 41 public segments at defence sites. Even those with more private profiles sometimes appeared on segment leaderboards by name. In at least 30 instances, these names facilitated the connection of activity across multiple military locations. Additionally, linked accounts and tagged workouts disclosed family relationships in 13 cases.
Some public profiles included more than route data, with users uploading workout titles, images, and videos related to training zones and military facilities. Several profiles displayed activity near Waiouru and other defence sites. One senior member of the NZDF used a real name while in the United States, with activity recorded near various military installations and close to New Zealand’s embassy in Washington.
Military guidance emphasizes risks associated with location data sharing
The New Zealand Defence Force has issued directives addressing the risks posed by fitness apps and social media. Personnel are advised to disable GPS tracking when at sensitive locations and to refrain from using their full names on fitness platforms. The organisation states that it regularly offers operational security guidance before deployments and other activities. Measures are in place to safeguard personnel, facilities, operations, and information. Nonetheless, NZDF does not have a specific policy for Strava or other fitness-tracking apps.
Strava provides features that can help users limit public exposure, including options to restrict activity visibility to followers, set profiles to private, or conceal parts of recorded routes. Users may also hide entire activity maps. The company recommends employing stronger privacy controls, especially near workplaces and sensitive sites. Activities set to followers-only or private do not appear on public segment leaderboards. The NZDF states that the existence of fitness data online does not automatically constitute a security breach.