Media: Strava app allowed Iran to obtain intelligence on the US military
A Sky News investigation has uncovered a massive leak of classified data. It turns out that more than 1300 users of the fitness app Strava posted their workout routes while on US military bases in the Middle East.
Not only routes but also daily routines of military personnel, troop movements, and activity at locations not marked on public maps became publicly available. Many users published the data under their real names, allowing for the identification of individual service members.
Security experts believe Iran used this information, combined with other intelligence, to monitor US forces and identify targets. Foreign media cite specific cases in Bahrain and Jordan, where changes in Strava activity appear to have revealed personnel deployment locations shortly before these locations were attacked by Iran. For example, at Muwaffaq al-Salti Air Base in Jordan, military personnel regularly posted running routes; after a pause in March, these routes resumed in April, but were now concentrated around the barracks—the very facility that was attacked in July, leading to the deaths, according to official reports, of three American soldiers.
The problem isn't new: back in 2018, the Pentagon warned that location data from fitness apps could endanger troops. At the same time, Strava's global activity map revealed the location of a previously unknown US base in Niger, as well as the positions Defense and fire bases in the Middle East. In response, the US Department of Defense banned military and civilian personnel from using geolocation features on official and personal devices. However, an investigation revealed that US and UK military personnel continue to ignore the ban and share activity from sensitive facilities, including the Akrotiri air base in Cyprus. Traces of app use were even found inside Israel's Dimona nuclear research center.
This isn't the first time fitness apps have been used to leak data about strategic assets. Similar incidents have previously occurred with NATO nuclear submarines: in 2022, British officers on duty aboard nuclear-armed submarines at the Faslane base forgot to enable privacy mode on Strava, revealing their names, addresses, and time on board. And in 2025, as Le Monde reported, at least 450 people with access to the top-secret French nuclear submarine base on the Ile Longue Peninsula were Strava subscribers; by analyzing sudden interruptions in their training, it was possible to determine the submarines' patrol dates at sea. That same year, 16 submariners from a NATO country, using smartwatches while jogging, leaked their submarine patrol schedules through Strava.
Strava said it offers users privacy controls and expects people working in sensitive areas to use them.
Information