Polarsteps Travel App Exposes Sensitive Location Data of 23 Million Users, Including Military Personnel A major privacy flaw in the Dutch travel app Polarsteps used by over 23 million people worldwide allowed unauthorized access to users' exact locations, photos, and personal details, including those of military personnel from the U.S., U.K., France, and Belgium. Security researchers and journalists from Follow the Money (FTM) exploited weak backend protections to scrape 230 million photos and videos, along with 1 billion GPS coordinates, revealing highly sensitive movements from holiday destinations to work trips and even children’s school drop-offs. ### Key Findings - Military & High-Risk Exposure: FTM tracked over 30 military personnel, including a U.S. Space Force officer whose travels across global bases from Florida to Qatar were fully mapped. Another case involved a U.S. Air Force mechanic whose posts revealed his residence at Ramstein and Spangdahlem bases in Germany, alongside personal photos of family visits. - Non-Public Data Accessible: Even users who restricted their profiles to followers only had their data exposed. FTM accessed 1 million private trips by exploiting a loophole where users could follow others without explicit consent. - Stalking & Blackmail Risks: Experts warned the exposed data could enable stalking, espionage, or blackmail, particularly for individuals in sensitive roles. The Dutch Ministry of Defence responded by banning Polarsteps on defense devices and warning personnel about risks on personal phones. - Long-Standing Vulnerability: A French cybersecurity researcher alerted Polarsteps to the issue in December 2025, but the company dismissed concerns, stating it had "assessed" the risk and made no changes. FTM’s investigation later confirmed the flaw remained exploitable for months. ### How the Breach Happened Polarsteps’ unrestricted API allowed anyone with basic technical knowledge to extract user data, including: - GPS coordinates of photos (even if not publicly visible in the app). - Home addresses and frequented locations (e.g., schools, military bases). - Photos of military installations, colleagues, and family members. The Dutch Data Protection Authority (AP) stated that companies must prevent large-scale data scraping, even from public profiles, under GDPR regulations. Privacy experts argued Polarsteps failed to adequately inform users about how their data was exposed. ### Company Response After FTM presented its findings, Polarsteps tightened security measures, including: - Requiring manual approval for new followers by default. - Exploring ways to automatically disable location tracking when users return home. - Reducing the amount of data shared via its API. However, previously scraped data remains in circulation, posing ongoing risks. The Dutch Ministry of Defence’s decision to block the app underscores the severity of the breach, particularly for personnel in national security roles.