WELLINGTON, NEW ZEALAND / RankWire.AI / – The New Zealand Defence Force has uncovered that publicly available fitness data has disclosed precise location details tied to hundreds of individuals using New Zealand Defence Force facilities. An investigation identified 565 Strava users who logged workouts at NZDF bases and camps since January. Of these, 488 accounts had publicly accessible profiles showing activity histories. While investigators could not confirm that every account belonged to defense personnel, most contained data suggesting a military connection.
The activity data spanned several prominent defense sites across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Additionally, users recorded workouts at Papakura Military Camp and the nearby Ardmore training area. Public segments on Strava covered routes inside or in proximity to defence facilities, with some segments bearing names associated with military fitness tests or key base landmarks. Multiple leaderboards displayed participant names for years.
The records also reveal activity beyond New Zealand’s borders. Users logged workouts at military locations in 13 different countries and territories, such as Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Some data originated from Antarctica. There are instances of users traveling repeatedly between New Zealand military sites and overseas locations, creating visible timelines that link individuals to specific places.
Public Profiles Reveal Travel and Training Data
Strava relies on GPS technology to track activities such as running, cycling, and walking, with public segments ranking users who complete the same routes. The investigation identified 41 public segments at defence sites. Even users with restricted profiles could sometimes be identified by name on segment leaderboards. In over 30 cases, these names helped connect activity across multiple military locations. Tagged workouts and linked accounts also uncovered family relationships in 13 instances.
Some publicly available profiles contained more than just route maps. Users uploaded workout titles, images, and videos associated with training zones and military installations. Several profiles showed activity around Waiouru and other defence locations. One high-ranking NZDF member used a real name while serving in the United States, with the account showing activity near multiple military installations, including runs close to New Zealand’s embassy in Washington.
NZ Defence Department Issues Location Data Security Advice
The New Zealand Defence Force has issued guidelines highlighting the security risks posed by fitness apps and social media. Military personnel are advised to disable fitness tracking features in sensitive areas and to avoid using full names on such platforms. The NZDF states that it also provides ongoing operational security guidance ahead of deployments and other activities. The organization employs measures to safeguard personnel, facilities, operations, and information, although it does not have a specific policy targeting Strava or similar fitness-tracking apps.
Strava offers several privacy features designed to minimize public exposure of location data, including options to restrict visibility to followers, set activities as private, or hide segments of recorded routes. Users can also completely hide activity maps. Strava recommends strengthening privacy controls in sensitive locations like workplaces. Activities limited to followers or marked private do not appear on public segment leaderboards. The NZDF emphasizes that having fitness data online does not necessarily equate to a security breach.