US military personnel are still publicly sharing workout data from bases across the Middle East, potentially exposing where troops gather and how they move, even after years of Pentagon warnings about the security risks of fitness-tracking apps.
An investigation by Sky News identified more than 1,300 Strava users who had shared thousands of workouts from US military installations in the region. Many accounts were linked to real names, while repeated GPS-recorded activities could reveal patterns around bases and accommodation areas. Some of the locations identified in the investigation have subsequently been targeted by Iran.
The reporting does not establish that Iran used Strava data to choose any specific target. But security specialists say publicly available fitness information could form part of the wider intelligence picture used to monitor American forces.
The revelation is especially striking because the Pentagon confronted essentially the same problem in 2018.
A running app turned into a military security problem
Strava is designed to make exercise trackable and social. Users can record runs, cycling routes and other workouts using GPS, then share information about where and when the activity took place. That feature becomes much more consequential when the route is inside a military installation.
In 2018, Strava's Global Heatmap exposed patterns of activity around military facilities and helped reveal locations and layouts that were not otherwise obvious from publicly available information. The controversy prompted the Pentagon to review the security implications of fitness trackers and other wearable devices.
In August 2018, the Department of Defense introduced restrictions prohibiting personnel from using geolocation features on government and personal devices in designated operational areas unless authorised. The policy specifically addressed technologies capable of revealing users' locations and movements.
Iran strikes bases where workout data is visible
The most concerning example highlighted by Sky News involves Muwaffaq Al Salti Air Base in Jordan. Before the war, US personnel were regularly recording runs at the base. According to Sky News' analysis, workout activity resumed during a ceasefire in April and became concentrated around accommodation areas on the installation's eastern side.
Publicly accessible activity was recorded on July 16, one day before an Iranian attack struck the base. The July 17 attack killed three US service members.
The exposure extends beyond US forces. Sky News also identified serving British personnel recording workouts at RAF Akrotiri in Cyprus, a site that has come under Iranian attack. Its investigation further found three Strava users tracking runs inside Israel’s Dimona nuclear research facility, another location repeatedly targeted by Iran.
A 2026 Le Monde investigation identified thousands of French military personnel through publicly accessible Strava profiles and showed how fitness data could expose sensitive deployments and movements.
There is no public evidence establishing that Iranian forces obtained or acted on those Strava records before the attack. The significance is instead that the data could potentially have revealed where personnel were routinely exercising or staying, providing another piece of information alongside satellite imagery, communications intelligence and other sources.
Joseph Jarnecki, a research fellow at the Royal United Services Institute, told Sky News that publicly accessible information of this kind could reasonably be expected to form part of an adversary's targeting picture.
Strava has said it takes user safety and privacy seriously and provides controls that allow users to restrict the visibility of their activities. The company has also made changes to its heatmap and privacy tools since the 2018 controversy.
