A Stars and Stripes review published August 14, 2026, found that users publicly shared Strava workouts from military bases across the CENTCOM region, revealing recurring routes, exercise locations and sometimes photos. Some activity was posted after restrictive geolocation controls took effect. The report did not establish that Iran used Strava data to select targets.
A Stars and Stripes review found that users of the Strava app repeatedly recorded and publicly shared details of their workouts at bases in several countries in the CENTCOM area of responsibility.
How-To Geek articles published May 26 and June 8, 2026, said Strava sets profiles and activities to public by default for new users aged 18 or older, and that routes and visible start times may help infer where someone lives. The writers described privacy controls users can change; one said a friend’s watch-linked activity revealed his home location.
If you’re 18 or older, Strava sets your profile and activity visibility to “Everyone” by default, meaning literally anyone can type your name in and see your runs. This alone isn’t too invasive, especially if you’re running in popular public areas that other runners and hikers also frequent.
One of the biggest issues with Strava is how it handles privacy and data out of the box. The app is built around its social features, so when you create an account, your profile and activities are set to be visible to everyone by default. On top of that, it’s cluttered with a range of privacy options that can be confusing to navigate, with some requiring you to opt out manually, making it easy to accidentally share more than you intended.
TechCrunch reported June 1, 2026, that Strava would require authentication to view some website data, charge developers a flat $11.99 monthly API fee (which may vary by geography), and retire some API endpoints after a 90-day grace period. CEO Michael Martin cited scraping and system strain; Strava said it aims to protect user data while supporting developers.
To stop scraping, the company is increasing security around its website and will now only allow authenticated users to view certain data. Earlier, users were able to see details like public profiles and fitness club listings without logging in.
A Strava heatmap published in January 2018 displayed activity routes, including those used by sailors and airmen on Diego Garcia, raising concerns about military operational security. Defense Secretary James Mattis ordered a review of wearable-device policies; the Pentagon said it would examine its policies but its spokesman was not aware the map had revealed sensitive or secret information.
The Pentagon has long wrapped Diego Garcia in a veil of secrecy, barring media from the Indian Ocean island even as its base and airfield became a key node in America’s wars in the Middle East. But a hole appeared in the veil last Saturday, when a mobile fitness-tracking app company called Strava posted a heatmap of its subscribers’ activity — including the routes that sailors and airmen take as they jogged.
In January 2018, researchers and news reports said Strava’s global heat map, built from users’ GPS activity, made routes and activity around remote military and other sensitive sites visible. Strava said it excluded activities marked private and respected privacy settings; senators later questioned whether its opt-out controls were clear and adequate. The Pentagon reviewed its policies.
In a blog post, in which he dubbed the problem "Fit Leaking," Scott-Railton said he looked at a portion of the available Strava data (all 1.3 terabytes of it) and was able to "identify several covert and non-declared operating bases, diplomatic outposts, and possible intelligence facilities in several ongoing conflict zones in Africa and the Middle East." In one case, he was able to look at activity in what's believed to be a drone warfare facility in the Middle East, whilst looking at routes around a Russian embassy in Damascus, Syria. Indeed, in Syria, it was possible to find possible routes between undeclared bases as well as regular patrol routes, he added. Others have found military bases in Taiwan and Afghanistan. Such information could be useful for anyone planning an attack.
That’s exactly what happened when Strava, a widely used app for tracking activity and exercise, released an “anonymized” heatmap of all its global data in November. The map only came to light this weekend after Australian student Nathan Ruser started digging into the data. With over 3 trillion coordinates at the street level from over 27 million fitness device users, like Fitbit and Jawbone, the GPS tracking company mapped out its aggregated data over the past two years of activity to reveal some of the most visited areas. Predictably, high population areas — like most of the US and Europe — are brightly lit up.
So how does it all work? Strava aggregates data from any GPS-enabled device, such as Fitbits, Garmins and cellphones so they can “connect the world’s athletes” on their own social media platform. At first glance, the Strava Labs heat map looks like a nighttime satellite image of Earth. Vibrant light emanates from rich areas like Europe, the United States, Japan and South Korea. Darkness envelops unpopulated or poorer areas like much of Africa, the Canadian Arctic, Tibet and North Korea. Closer inspection, however, reveals that people are transmitting data from even some of the darkest corners of the world.
Strava assembled exercise information from about 27 million participants and aggregated it anonymously into an interactive “global heat map” that showed where people have been exercising for the past two years. The map became available in November and widely publicized in January.
But what makes the Strava data breach so remarkable is that it wasn't isn't a hack at all. It was just a poorly conceptualized feature: A basic heat map visualization designed to show where its users are at any given time. And this isn't a financial institution or potential marriage-ending service like Ashley Madison. It's a fitness app. The worst thing that should be possible from such a service's data is the public realization that we're slacking on our workouts. Never in the history of a data breach has there been such a disconnect between the mundane innocence of a company and the real-world repercussions of its data.
Strava — which includes an option for keeping users' workout data private — published the updated Heat Map late last year. The California-based company calls itself "the social network for athletes," saying that its mobile apps and website connect millions of people every day.
On March 11, 2022, Strava announced it was ending services in Russia and Belarus following Russia’s invasion of Ukraine. CEO Michael Horvath said the company stood with Ukraine; he also said Strava was providing humanitarian aid and promoting a challenge intended to encourage donations to the International Red Cross.
Athletic social networking service Strava announced on Friday it is ending services in Russia and Belarus due to Moscow’s invasion of Ukraine, joining numerous other businesses and organizations.
A lobbying disclosure lists issues concerning privacy and security of the Strava community, content moderation and algorithms. It names the Senate, House and White House Office as bodies addressed and identifies Matthew Tanielian, Joshua Ackil, Sarah Beth Jansen, Wesley McClelland, Kevin Cummins and Nelson Litterst as lobbyists. The filing provides no dates or specific policy requests.
Issues related to protecting the privacy and security of the Strava community;
A lobbying disclosure lists “health, wellness, nutrition, and exercise” as an issue area and identifies the White House Office as the body addressed. Joshua Ackil is named as a lobbyist. The filing does not describe a particular proposal, position, outcome or filing date.
Issues related to health, wellness, nutrition, and exercise
A lobbying disclosure lists recreational opportunities and the Expanding Public Lands Outdoor Recreation Experiences Act (PL No. 118-234) as issues before the U.S. House of Representatives. It names Matthew Tanielian, Joshua Ackil, Sarah Beth Jansen, Wesley McClelland, Kevin Cummins and Nelson Litterst as lobbyists; it gives no specific requested action or outcome.
A lobbying disclosure lists “issues related to promoting active transportation” and identifies the U.S. Senate and House of Representatives as the bodies involved. The filing names Matthew Tanielian, Joshua Ackil, Sarah Beth Jansen, Wesley McClelland, Kevin Cummins and Nelson Litterst as lobbyists; it does not specify the proposals or outcomes.
A public lobbying filing for Strava contains the heading “Specific lobbying issues.” The supplied excerpt provides no further detail about the issues, lobbying activity, timing or outcome.