A data exposure incident at Hello Gym, a Minnesota-based fitness technology service provider, revealed an unsecured database containing 1.6 million audio recordings (phone calls and voicemails) of gym members from 2020 to 2025. The exposed files included Personally Identifiable Information (PII) such as customer names, phone numbers, and call details, collected by independent gym franchisees via Hello Gym’s third-party service. The database lacked password protection, allowing unauthorized access until researchers disclosed the vulnerability.The breach poses severe risks, including spear-phishing, deepfake scams, and identity theft, as cybercriminals could exploit voice recordings to impersonate individuals or gym staff. While the database was secured post-disclosure, the duration of exposure and potential unauthorized access remain unknown. The incident underscores critical lapses in data security, leaving customers and employees vulnerable to fraud and malicious exploitation of sensitive personal data.