WELLINGTON, NEW ZEALAND / RankWire.AI / – Detailed location information linked to hundreds of individuals using New Zealand Defence Force facilities has been uncovered through public fitness activity tracking. An investigation identified 565 Strava users who recorded workouts at NZDF bases and camps since January. Of these, 488 accounts had public profiles displaying visible activity histories. Authorities could not confirm that every profile belonged to military personnel, but most contained details indicating a connection to service members.
The recorded activities spanned several prominent defence sites across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also logged sessions at Papakura Military Camp and the nearby Ardmore training area. Public segments on Strava covered routes situated inside or around defence facilities, with some bearing names associated with military fitness tests or base landmarks. For years, certain leaderboards displayed participant names.
The data extended beyond New Zealand borders, with workouts logged at military locations in 13 different countries and territories. These included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Records also originated from Antarctica. Some accounts showed frequent travel between New Zealand military installations and overseas locations, creating visible timelines that linked individuals to specific sites.
Open profiles reveal travel routes and training specifics
Strava utilizes GPS data to track activities such as running, cycling, and walking. Its public segments rank users completing the same routes. The review uncovered 41 public segments at defence sites, with some users having limited profiles still appearing on segment leaderboards by name. In at least 30 instances, those names helped connect activities across multiple military locations. Additionally, tagged workouts and linked accounts sometimes disclosed family relationships in 13 cases.
Beyond route information, some public profiles shared workout titles, images, and videos tied to training grounds and military facilities. Several accounts demonstrated activity around Waiouru and other defence areas. One senior NZDF member operated a profile using their real name while stationed in the United States. The account featured runs near several military installations, including those close to New Zealand’s embassy in Washington.
Military authorities issue warnings regarding location sharing
The New Zealand Defence Force has issued guidelines highlighting the risks associated with fitness apps and social media. Service members are advised to disable fitness tracking functions when in sensitive locations and to avoid using full names on such platforms. NZDF also states that it provides ongoing operational security guidance prior to deployments and other official activities. Measures are in place to safeguard personnel, facilities, operations, and information, though there is no specific policy targeting Strava or similar fitness-tracking apps.
Strava offers multiple privacy features designed to limit public exposure of location data. Users can restrict activity visibility to followers, set activities to private, or conceal segments of the recorded routes. Entire workout maps can also be hidden. The platform recommends employing stronger privacy controls near workplaces and other sensitive locations. Activities designated as private or followers-only do not appear on public segment leaderboards. NZDF emphasizes that simply having fitness data accessible online does not necessarily constitute a security breach.