Nearly 1 million Belgians who have used the popular travel app Polarsteps have had their data public for several months. This includes data on military personnel and other sensitive location information, according to the Dutch investigative platform Follow the Money (FTM).
The information came about as a French cybersecurity specialist tipped off FTM journalists after he reportedly found that the backend of the app revealed much more information than a normal user can see in the app. In some cases, people’s home and workplace addresses, names and pictures of their families were accessible.
Polarsteps started out as a hobby project by four Dutch friends and allows travellers to record their journeys, upload photos and videos and automatically map their movements. The app grew very successful, amounting to 23 million users worldwide today.
By accessing its application programming interface (API), reporters collected more than one billion GPS locations and were able to identify users who had visited sensitive sites such as military bases, barracks and training grounds.
Related News
- EU says Meta should step up teen protection following historic US fine
- Concerns about privacy: Half of Belgians distrust technology at events
Cybersecurity expert Eddy Willems told VRT NWS that API, which is "the piece that sits between the servers and the data” is a major problem for many apps today, since “more data in the app makes the API more complex," he said.
In some cases, military personnel had shared their locations for months, making it possible to identify places they regularly visited outside work. FTM said it was also able to access information from trips that users believed they had shared only with approved followers.
The investigation ultimately retrieved some 230 million photos and videos posted by users. Some images showed military personnel in uniform, the names and interiors of military bases and military aircraft.
Cybersecurity experts warned FTM that such information is worth gold for foreign intelligence services as it can be exploited for stalking, espionage or blackmail.
"Public on Polarsteps is more public than you might expect, and private is less private," Paul Pols, chief technical officer at Bureau Veritas Cybersecurity and a lecturer at Leiden University, told FTM.
The problem had reportedly been known to Polarsteps since at least December 2025, when a French cybersecurity specialist warned the company about information accessible through its backend. FTM said the company subsequently introduced several security measures after being confronted with the investigation's findings.
Polarsteps CEO Clare Jones acknowledged that the company should have identified the issue itself and said it was examining its systems to determine whether further problems remained.
The Belgian Defence Ministry informed VRT NWS that it was aware of the security risks associated with apps that collect, record and process or share location data, and that its usage is absolutely prohibited in the vicinity of all military installation and during military operations.
The Dutch Defence Ministry has since said it will add Polarsteps to its list of prohibited applications on staff devices. Personnel will also be warned about the risks of using the app on personal phones around military sites.
Data downloaded before the security changes might, nevertheless, still be accessible to those who obtained it, including location information and photographs linked to military sites and private addresses.
