InfoSecBulletin Cybersecurity for mankind
Security researcher Jeremiah Fowler discovered a database containing sensitive information from gym customers and staff, including names, financial details, and possible phone call, left unencrypted and unprotected. Jeremiah Fowler claims he discovered the wide-open AWS repository managed by HelloGym in late July.
The database was open for a week, and Fowler noted that identifying who managed the audio call repository required some effort.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
“It was only after calling, asking individual gyms that mentioned their locations in the recording,” he told The Register. “I asked who they use to record their calls and one of the managers finally told me.”
HelloGym offers sales, marketing, phone-answering, and VoIP services for major gyms like Anytime Fitness, Snap Fitness, and UFC Gym. Their database includes 1.6 million audio files from various franchise locations of leading fitness brands in the US and Canada.
HelloGym declined to comment for this story, the register reported.
The MP3 audio recordings include people’s names, phone numbers, and reasons for the calls, like renewing or canceling memberships. They were collected between 2020 and 2025, based on file dates and timestamps. According to Fowler, the database was likely a storage repository for VoIP audio files intended for internal use only.
“A very large number of the recordings referenced payment and billing issues,” Fowler said. “Although I didn’t hear any credit card numbers in the audio, it shows that members were comfortable discussing payment information over the phone.”
Intercepting the call, pretending to be a gym employee, and tricking the member into sharing payment information or paying a fake fee – and then stealing their credit card or bank account details.
The audio files could be played in any web browser without requiring specialized software or a password to listen to them. Fowler advises using encryption to protect files from being easily readable if exposed. He also recommends penetration testing to find misconfigured or open storage systems.
Finally, he advises businesses to segment data that they are no longer using. “Far too often I see organizations storing years’ worth of records in a single database and not deleting old files,” Fowler said. “As a general rule, it is a good strategy to securely back up old data to limit the exposure in the event of a data incident.”
