In April 2026, an investigation by the i Paper revealed that 519 individuals — military officers, defence contractors, intelligence staff and their relatives — had been broadcasting their movements from Britain's most sensitive military installations via Strava. Nuclear submarine bases, ballistic missile early warning stations and central command headquarters were all compromised. The data was freely available to anyone with an internet connection. If fitness apps can expose the movements of personnel guarding the UK's nuclear deterrent, what are they revealing about your business?
The Breach: 519 Personnel at Britain's Most Sensitive Sites
The investigation examined publicly available Strava data logged at restricted UK military sites since January 2026. Across nuclear bases, intelligence headquarters and early warning installations, hundreds of individuals had recorded exercise activities — jogging routes, cycling loops, walking commutes — with their Strava profiles set to public.
This was not a sophisticated cyber attack. No encryption was broken, no firewalls bypassed. Every piece of data was sitting in plain sight, voluntarily uploaded by the very people whose movements should be most carefully guarded.
Which Sites Were Exposed
| Installation | Strategic Role | Strava Exposure | Intelligence Risk |
|---|---|---|---|
| HMNB Clyde (Faslane) | Home of Trident nuclear deterrent | 110 tracked; one route identified a submarine deployment | Nuclear capability mapping, crew identification |
| Northwood HQ | UK military central command | Senior staff with public profiles | Command structure exposure, blackmail risk |
| RAF Fylingdales | Only UK ballistic missile early warning system | Engineers identifiable through exercise data | Personnel targeting, capability intelligence |
| Joint UK-US Installation | Classified joint operations facility | One route literally labelled "Security Breach" | Allied operations compromise |
A senior defence source described the exposed data as "damn good intelligence for the enemy." The ability to identify who works at a nuclear submarine base, where they live and what their daily routines look like represents a significant intelligence windfall.
How Strava Creates a Surveillance Map
Strava is not simply recording that someone went for a jog. It builds a detailed, timestamped, GPS-precise record of human movement — and by default, shares it with the world. When a user records an activity with default settings, the following becomes publicly accessible:
- Precise GPS coordinates — accurate to within a few metres, showing exact routes
- Timestamps — when activities start and end, revealing daily schedules
- Frequency patterns — regular routes expose where someone lives, works and socialises
- Personal profile data — real names, photos, linked social media accounts
Intelligence professionals call this "pattern of life" data — precisely the type of information that hostile actors use to build profiles of targets. Repeated jogging routes reveal home addresses. Lunchtime walks reveal workplaces. Weekend cycles reveal social connections.
Strava's default privacy setting has been public since the app launched. Every new account shares all activity data with the world unless the user manually changes their settings. This single design decision is the root cause of every military and corporate data leak involving the platform.
A Pattern of Failures: Fitness App Security Timeline
The April 2026 UK investigation is not an isolated incident. It is the latest in a pattern stretching back nearly a decade — each breach more consequential than the last.
| Year | Incident | Impact |
|---|---|---|
| 2018 | Strava Global Heatmap revealed secret US military bases | Forward operating bases in Syria, Afghanistan and Djibouti exposed |
| 2025 | French submarine crew at Île Longue exposed patrol schedules | Nuclear submarine patrol patterns revealed through running data |
| Mar 2026 | French naval officer revealed aircraft carrier position | Active military deployment compromised via Strava activity |
| Apr 2026 | 519 UK personnel exposed at nuclear and intelligence sites | Pattern-of-life data for Trident base and command staff |
Estimated percentage of users with location data publicly accessible, based on default settings and typical user behaviour.
The MoD's response was remarkable in its complacency: "Use of fitness apps is not considered an operational threat." Conservative MP Ben Obese-Jecty, a former army officer, responded: "It beggars belief that our armed forces don't have a grip of this."
Why This Matters for Your Business
If you're thinking "we're not a military target", consider what the same data reveals about a commercial organisation. Every employee with a public fitness tracking profile is potentially broadcasting:
- Office locations and working hours — morning jogs that start or end at your premises
- Client site visits — sales teams who track activities during travel reveal who you're working with
- Executive travel patterns — when senior leadership is away, creating security and social engineering risks
- Facility usage — when offices are empty, when shifts change, when security is lightest
- Business relationships — regular visits to an acquisition target become visible to competitors
- Home addresses of key personnel — particularly concerning for finance directors and legal teams
For regulated sectors — finance, legal, defence supply chain — the risks compound. A solicitor's regular visits to a corporate client during rumoured acquisition activity is market-sensitive information. A financial adviser's visits to a company before a public announcement could constitute insider trading evidence.
"The military breach is a warning shot for every business. If nation-state intelligence agencies are exploiting fitness app data, you can be certain that corporate espionage operatives and sophisticated criminals are doing the same."
The BYOD Blind Spot
Most UK businesses have some form of BYOD policy covering email, documents and passwords. What they almost universally fail to address is location-sharing applications. Your BYOD policy might ensure corporate emails are encrypted — but if your sales director's Strava profile broadcasts every client visit, the information security is illusory.
Percentage of UK SME BYOD policies that include provisions for each security area.
GDPR and Your Legal Obligations
GDPR creates specific obligations for employers regarding personal data — including location data employees may inadvertently share through personal devices used for work. Whilst employers cannot directly control personal apps on personal devices, they have obligations under GDPR's accountability principle to take reasonable steps and raise awareness.
- Duty of care — inform staff about location data risks when personal devices are used for business
- Data Protection Impact Assessments — BYOD policies should assess location-sharing risks
- Training obligations — awareness training should cover fitness apps, not just phishing
- Incident response — if location data leads to a breach, regulators will scrutinise preventive measures
- Third-party risk — contractors using fitness apps at your premises could expose operations
Include fitness and location-sharing apps in your next Data Protection Impact Assessment. The ICO considers location data particularly sensitive under GDPR, and demonstrating you have assessed these risks strengthens your compliance position significantly.
Which Apps Leak Data — and How to Lock Them Down
Not all fitness apps present equal risk. The key variable is the default privacy setting. Here is what your IT team needs to know.
Strava
- Enhanced Privacy Mode — prevents your profile appearing in leaderboards and flyby data
- Hide Start/End Points — masks a 200-metre radius around home and office
- Default Activity Privacy — change from "Everyone" to "Only You" or "Followers"
- Map Visibility — set to "Only You" to prevent public route data
Apple Health and Google Fit
Both offer per-app location access controls. Restrict background location access — many fitness apps request "Always" when "While Using" is sufficient.
Garmin Connect
Privacy Zones mask activity within a configurable radius of sensitive locations, plus global visibility settings for activities and profiles.
Fitbit
Activities can be set to private by default, with granular controls over community and third-party data sharing.
No Policy vs Comprehensive BYOD
No Location Data Policy
Comprehensive BYOD with Location Controls
Practical Steps for IT Managers
Addressing fitness app location risks does not require enterprise-grade infrastructure or a six-figure budget. These practical steps will dramatically reduce exposure for most UK SMEs.
1. Audit Current Exposure
Search for your company name, office address and key employee names on Strava's athlete search and segment explorer. You may be surprised at how much is already publicly visible.
2. Update Your BYOD Policy
Add a specific section on location-sharing applications covering fitness trackers, running apps and social media check-ins. Require employees using personal devices for business to:
- Set fitness app profiles to private
- Enable privacy zones around office locations and client sites
- Disable background location access for non-essential apps
- Review app permissions quarterly
3. Train Staff with Real Examples
Use the Strava military leak as a concrete example in security awareness training. Show staff how to check their own privacy settings during the session — it makes the abstract risk tangible.
4. Prioritise High-Risk Roles
Focus on employees whose movement patterns reveal the most: senior leadership, sales teams, consultants visiting client sites, and anyone in regulated sectors.
5. Review Contractor and Visitor Policies
Third parties visiting your premises may also broadcast location data. Consider guidance on pausing fitness tracking during site visits, particularly for sensitive facilities.
Implementation Priority for UK SMEs
The Espionage Context
This is not hypothetical. The investigation highlighted active espionage operations at the very installations where Strava data was being leaked. An Iranian man and a Romanian woman were charged in connection with suspected espionage at HMNB Clyde — the same base where 110 individuals were broadcasting movements via Strava. Drone sightings around UK bases have increased significantly, and analysts believe public location data could plan surveillance operations or guide precision strikes.
For businesses, the equivalent threats are corporate espionage, competitive intelligence and targeted social engineering. A competitor tracking your sales team's movements knows who you're pitching to before any deal is announced. A criminal mapping your CEO's routine has the foundation for a sophisticated impersonation attack.
"We are asking military personnel to protect nuclear weapons, yet we cannot even ensure they switch their running app to private. The same complacency exists across British business."
What Needs to Change
The Strava military leak is a symptom of the technology industry's preference for public-by-default settings that prioritise engagement over privacy. Until platforms change their defaults — which Strava has refused to do despite eight years of military data leaks — the burden falls on organisations to protect themselves.
For UK businesses, this means treating fitness and location-sharing apps with the same seriousness as email security. The data these apps generate is, as one defence source put it, "damn good intelligence" — and good intelligence about your business is worth money to competitors and a weapon in the hands of criminals.
The fixes are straightforward: privacy settings exist on every platform, policy updates are a matter of documentation, and staff training can be incorporated into existing programmes. The only thing required is the decision to act.
Protect Your Business from Location Data Risks
CloudSwitched helps UK businesses implement comprehensive cybersecurity policies and IT support — including BYOD controls, staff awareness training and location data risk assessments. Whether you need Cyber Essentials certification or ongoing IT support to keep your policies current, our team is ready to help.
Get in Touch
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
