WELLINGTON, NEW ZEALAND / RankWire.AI / – A public activity tracking of fitness routines has uncovered precise location information associated with hundreds of individuals exercising at New Zealand Defence Force sites. An investigation identified 565 Strava users whose workout data was recorded at NZDF facilities since January. Of these, 488 accounts had visible profiles displaying activity logs. Authorities could not confirm that all accounts belonged to defence staff; nevertheless, the majority exhibited details suggesting links to military personnel.
Multiple prominent defence locations across New Zealand showed activity logs. These locations included Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Workouts were also logged at Papakura Military Camp and the nearby Ardmore training zone. Publicly accessible Strava segments depicted routes either inside or around military grounds, with some segment names referencing military fitness tests or base landmarks. Certain leaderboards displayed participant names for several years.
The data also revealed activity outside New Zealand’s borders. Users submitted workout records at military sites spanning 13 different countries and territories, including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Some entries originated from Antarctica. The logs indicated repeated travel between New Zealand military locations and overseas facilities, creating visible timelines that linked individuals to specific sites.
Public Profiles Reveal Movement and Training Patterns
Strava’s GPS-based tracking captures activities such as running, cycling, and walking. Its public segments enable ranking users who complete identical routes. The review uncovered 41 such segments at defence sites. Even accounts set to private sometimes appeared by name on leaderboards. In at least 30 instances, these names connected activities across various military locations. Additionally, tagged workouts and linked profiles exposed family relationships in 13 cases.
Beyond route data, some public profiles included workout titles, images, and videos linked to training zones and military installations. Profiles showed activity around Waiouru and other defence sites. One senior member of NZDF used their real name while stationed in the United States. The account’s activity encompassed several military installations and runs near New Zealand’s embassy in Washington.
Official Advice Highlights Location Data Risks
Guidelines issued by the New Zealand Defence Force emphasize the dangers associated with fitness apps and social media sharing. Personnel are advised to disable fitness tracking features in sensitive areas and refrain from using real names on such platforms. The NZDF states that it regularly provides operational security instructions ahead of deployments and other activities. Measures are in place to safeguard personnel, facilities, operations, and sensitive information. Nonetheless, the organisation does not have a specific policy addressing Strava or similar fitness-tracking services.
Strava offers multiple privacy features that can mitigate public location sharing. Users can restrict activity visibility to followers, set activities to private, or conceal parts of the recorded route. Entire activity maps can also be hidden. Strava recommends applying stronger privacy controls around workplaces and critical sites. Activities restricted to followers or kept private are excluded from public segment leaderboards. NZDF remarks that having fitness data online does not necessarily constitute a security breach.