WELLINGTON, NEW ZEALAND / RankWire.AI / – In New Zealand, recent public fitness activities have uncovered sensitive location data associated with hundreds of individuals using New Zealand Defence Force facilities. An investigation identified 565 Strava users who documented workouts at NZDF bases and camps since January. Of these, 488 profiles featured public settings with visible activity histories. Authorities could not confirm that every account belonged to military personnel, but most displayed information suggesting links to military service.
The recorded activities spanned multiple key defense locations across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also tracked workouts at Papakura Military Camp and the nearby Ardmore training zone. Public Strava segments covered routes within or near defense sites, some bearing names connected to military fitness assessments or landmarks. Leaderboards had listed participant names for several years.
Furthermore, the data revealed activity beyond New Zealand’s borders. Users registered workouts at military sites across 13 countries and territories, such as Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Records also originated from Antarctica. Some profiles showed frequent trips between New Zealand military bases and overseas locations, creating detailed timelines that linked individuals to specific places.
Public Profiles Reveal Movement Patterns and Training Data
Strava utilizes GPS tracking to log activities like running, cycling, and walking, allowing public segments to rank users completing the same routes. The review uncovered 41 public segments at defense sites. Even users with restricted profiles occasionally appeared on segment leaderboards by name. In at least 30 cases, those names helped connect activity across various military locations. Additionally, tagged workouts and linked accounts identified family connections in 13 instances.
Some public profiles included more than route information, with users uploading workout titles, photos, and videos related to training areas and military facilities. Multiple profiles showed activity around Waiouru and other defense locations. One senior member of the NZDF used their real name while in the United States, with activity recorded near multiple military installations and near the New Zealand embassy in Washington.
NZ Defense Department Issues Advisory on Location Data Risks
The New Zealand Defence Force has issued guidance highlighting the security risks linked to fitness apps and social media. Service members are advised to disable GPS tracking when in sensitive areas and to refrain from using their full names on fitness platforms. The NZDF states it offers ongoing operational security advice prior to deployments and other military activities. The organization also has measures to safeguard personnel, facilities, operations, and sensitive information. Nevertheless, the NZDF does not have a specific policy tailored to Strava or similar fitness-tracking apps.
Strava provides several privacy tools to help users reduce the exposure of their location data. Options include limiting visibility to followers, setting activities as private, or hiding parts of recorded routes. Users can also hide entire activity maps. Strava recommends enabling stronger privacy controls when near workplaces and other sensitive sites. Activities restricted to followers or set as private do not show up on public segment leaderboards. The NZDF emphasizes that having fitness data online does not automatically constitute a security breach.