Addresses of Military Personnel Leaked by Polar Flow App

• Running watch manufacturer Polar suffered a potential data leak through its Polar Flow App which revealed personal addresses of military personnel.
• A data leak is possible because of the Explore tab in the Polar Flow app which is flawed in design and allowed investigators to find details of over 6000 users across 69 countries.
• To prevent the issue, users are requested to set their profiles as private in the Polar Flow app until the manufacturer resolves the issue. 

Finnish smart wearable company Polar shut down its Explore feature because of a vulnerability in its Polar Flow app. The company is known for its popular smartwatches and running watches, which can sync with the Polar Flow app and offer fitness insights. The Polar Flow app includes an Explore feature which allows users to see anonymous data of other fitness enthusiasts using the app including workout regimens and country. However, a vulnerability in the app allowed investigators from De Correspondent and Bellingcat to discover personal addresses of intelligence operatives, military personnel, and professionals who work at nuclear weapons storage facilities. Names and addresses of 6,460 users from 69 countries were discovered by the investigators.

Image Courtesy of De Correspondent

Polar has disabled the Explore functionality temporarily until the vulnerability is patched. The Explore feature has logged all activity of users dating back to 2014 since its launch. While the vulnerability doesn’t directly display the address of its users, it is easy to make out a person’s location based on jogging routes.

Polar made a blog post which stated, “We are analyzing the best options that will allow Polar customers to continue using the Explore feature while taking additional measures to remind customers to avoid publicly sharing GPS files of sensitive locations.”

The company revealed that there is no known instance of a data breach and the recent discovery by the investigators forced the company to shut down the Explore feature indefinitely. The wearables manufacturer will be restoring the feature soon while also reducing the risks involved with the GPS feature. Users have been requested to not reveal their private GPS data from sensitive locations and should set their profiles to private which prevents third-party apps from collecting GPS data.

Do you use Polar Flow? Let us know in the comments below. Also, to get instant tech updates, Follow TechNadu’s Facebook page, and Twitter handle.