Strava Exposed 4,000 NATO Troops' Data in Belgium
In short: Belgium's Defence Minister Theo Francken confirmed a data leak affecting up to 4,000 troops — not the result of a hack, but of years of soldiers running public Strava profiles while training on sensitive sites. Open workout routes, names, photos and follower lists made it possible to identify military personnel and map restricted NATO facilities in Belgium, including the Kleine-Brogel air base, reportedly home to US tactical nuclear weapons. The data goes back to 2014, and the minister said removing what's already public is practically impossible.
What happened
A Belgian investigation found that around 4,000 service members used personal smartphones running Strava while on duty or training inside protected facilities. By default, the app publishes a run or ride route down to the meter, and a user's profile — name, photo, bio and friend list — stays visible to strangers unless the owner manually locks it down. By cross-referencing dozens of overlapping routes inside the same fenced perimeter, it became possible to reconstruct the layout of a secure site and the identities of the people stationed there.
Exposed locations include NATO's Brussels headquarters, the Supreme Headquarters Allied Powers Europe (SHAPE) command centre in Mons, the Kleine-Brogel and Florennes air bases (home to F-35 fighters), and the Zeebrugge naval base. Similar fitness-app location leaks have hit militaries elsewhere before, but the scale of Belgium's officially confirmed case is among the largest to date. We've covered a similar digital-footprint deanonymization mechanism in our piece on privacy news.
Why this is a careless leak, not a hack
The key difference from a typical cyber incident: attackers didn't have to breach anything. All the information was public by default — Strava shares workouts openly unless a user explicitly switches on privacy mode in settings. Francken placed responsibility squarely on personnel, pointing to device-use instructions in force since 2014 that were widely ignored.
Strava's segments feature compounds the risk: the app automatically ranks everyone who has run the same stretch of road, letting an outside observer search for anyone who routinely "checks in" inside a specific military base — without knowing in advance who serves there.
What it means for everyday users
This isn't just a military problem. Any fitness, running, or cycling app can, by default, reveal your home address (as the starting point of your morning run), your workplace, and your routine routes — and therefore when you're not home. For public figures, law-enforcement personnel, and anyone connected to a sensitive site, this is a direct physical-safety risk, not an abstract "data leak."
There's also no real undo button: third-party aggregator sites and archives tend to scrape public tracks long before a user notices and locks down their profile.
How to protect your location
First, manually review the privacy settings in your fitness apps: hide your profile from strangers, turn off publishing the exact start and end points of your route (Strava offers "privacy zones" for this), and don't accept follow requests from unknown accounts. Second, avoid carrying work or personal devices with location tracking enabled onto grounds where your mere presence is sensitive information.
A VPN doesn't close this particular leak — it happened inside the app itself, not through intercepted traffic — but it reduces a related risk: it encrypts your connection and hides your real IP address and ISP from the services you connect to, including fitness platforms, when you route through the LiMP VPN app. It won't stop an app from publishing your route if you haven't locked down your profile, but it removes another channel that can tie your activity to a real-world location and network. See the LiMP VPN features page for a clear breakdown of what a VPN does and doesn't protect.