Data of 900 Dutch soldiers leaked through fitness app Strava
Omroep Gelderland has obtained the data of 900 Dutch soldiers through the fitness app Strava. The broadcaster found the names of all the soldiers, profile pictures for most of them, and where they live for about half.
“It is really bad,” Matthijs Koot, an expert in the field of digital data protection, told the broadcaster. We are talking aobut the data of 900 soldiers and that is a lot. This way you can easily put yourself on the enemy’s radar.”
Strava creates ranking lists with the fastest times on certain routes. All athletes who complete a certain route end up on its ranking. Omroep Gelderland looked up rankings for routes on all major military bases in Gelderland on Strava’s website. “Because those routes are located on a secure Defense site, where only soldiers can exercise, everyone on that ranking list is in principle also a soldier,” the broadcaster said.
It took the broadcaster less than an hour to identify 900 Dutch soldiers. It took one as an example and googled her name, finding her public Facebook account with photos, addresses, and friends on the second try.
The army leadership has been warning soldiers to be careful when using social media and location-tracking apps like fitness apps. “The enemy could indeed misuse this information,” a Defense spokesperson told the broadcaster. “Soldiers are then put under pressure, with all possible consequences. For themselves and their families, but also for national security.”
Strava users can set their accounts to private to protect their data. Then only invited people can see their activities. A quarter of the Dutch soldiers Omroep Gelderland found had a private account, but it still showed their profile picture and their names still appear in the Strava rankings.
That also means that three-quarters of the Dutch soldiers have public accounts, showing all their activities, including when they exercise abroad. For example, Omroep Gelderland found two soldiers jogging at Campia Turzi air base in Romania in the summer of 2024, where Dutch soldiers help guard NATO’s eastern flank with Reaper drones. One of those soldiers has now moved to the Amari Air Base in Latvia, where Dutch F-35 fighter jets are stationed to monitor NATO airspace.
“It is unbelievable that these tracking apps are not explicitly prohibited on military bases,” GroenLinks-PvdA parliamentarian Jimme Nordkamp told the broadcaster. “We need to take the safety of our own people and military activities more seriously, especially in these times of international tensions.” He will ask Defense Minister Ruben Brekelmans about this.
The Ministry told Omroep Gelderland that it advises military personnel to set their accounts on private, not to use certain apps at Defense locations, and not to identify themselves as soldiers online.
