WELLINGTON, NEW ZEALAND / RankWire.AI / – A significant security concern has emerged after public fitness activity data revealed precise location details associated with hundreds of individuals using New Zealand Defence Force sites. An investigation uncovered 565 Strava users who recorded exercise sessions at NZDF facilities from January onward. Of these, 488 accounts featured public profiles displaying activity histories. While investigators could not confirm that every account belonged to defence staff, most contained information suggesting a link to military service.
These activity records spanned several prominent defence locations throughout New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also logged workouts at Papakura Military Camp and the nearby Ardmore training area. Public segments on Strava showed routes that passed through or circled defence installations. Some segment names referenced military fitness assessments or base landmarks, and participant names had been visible on leaderboards for years.
The data also extended beyond New Zealand’s borders, with activity logs at military sites across 13 countries and territories. Locations appeared in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Records from Antarctica were also identified. Some accounts indicated frequent travel between New Zealand military sites and overseas locations, creating visible timelines that linked individuals with specific places.
Public Profiles Reveal Movement and Training Details
Strava’s GPS-tracking features document activities such as running, cycling, and walking. Its public segments rank users who complete identical routes, and the review identified 41 such segments at defence sites. Even users with restricted profiles sometimes appeared by name on leaderboard listings. In over 30 cases, these names helped establish connections between activities at different military locations. Additionally, tagged workouts and connected accounts uncovered family relationships in 13 instances.
Beyond route data, some public profiles displayed workout titles, images, and videos linked to training areas and military facilities. Multiple profiles showed activity around Waiouru and other defence sites. One senior member of NZDF used a real name while serving in the United States; their account displayed activities near several military installations as well as runs close to New Zealand’s embassy in Washington.
Official Guidance Highlights Location Data Risks
The New Zealand Defence Force has issued recommendations addressing the dangers posed by fitness apps and social media. Personnel are advised to disable fitness tracking functions at sensitive locations and to avoid using their full names on fitness platforms. NZDF also states it provides ongoing operational security advice prior to deployments and other critical activities. While the organization has measures in place to safeguard personnel, facilities, operations, and information, it does not have a specific policy tailored to Strava or similar fitness-tracking services.
Strava offers several privacy features that can help limit location data exposure. Users can restrict activity visibility to followers, set activities to private, or hide sections of recorded routes. Entire activity maps can also be concealed. Strava recommends strengthening privacy controls especially near workplaces and sensitive locations. Activities shared only with followers or kept private are excluded from public segment leaderboards. The NZDF emphasizes that having fitness data available online does not inherently constitute a security breach.