InfoSecBulletin Cybersecurity for mankind
Security researcher Jeremiah Fowler discovered a database containing sensitive information from gym customers and staff, including names, financial details, and possible phone call, left unencrypted and unprotected. Jeremiah Fowler claims he discovered the wide-open AWS repository managed by HelloGym in late July.
The database was open for a week, and Fowler noted that identifying who managed the audio call repository required some effort.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
“It was only after calling, asking individual gyms that mentioned their locations in the recording,” he told The Register. “I asked who they use to record their calls and one of the managers finally told me.”
HelloGym offers sales, marketing, phone-answering, and VoIP services for major gyms like Anytime Fitness, Snap Fitness, and UFC Gym. Their database includes 1.6 million audio files from various franchise locations of leading fitness brands in the US and Canada.
HelloGym declined to comment for this story, the register reported.
The MP3 audio recordings include people’s names, phone numbers, and reasons for the calls, like renewing or canceling memberships. They were collected between 2020 and 2025, based on file dates and timestamps. According to Fowler, the database was likely a storage repository for VoIP audio files intended for internal use only.
“A very large number of the recordings referenced payment and billing issues,” Fowler said. “Although I didn’t hear any credit card numbers in the audio, it shows that members were comfortable discussing payment information over the phone.”
Intercepting the call, pretending to be a gym employee, and tricking the member into sharing payment information or paying a fake fee – and then stealing their credit card or bank account details.
The audio files could be played in any web browser without requiring specialized software or a password to listen to them. Fowler advises using encryption to protect files from being easily readable if exposed. He also recommends penetration testing to find misconfigured or open storage systems.
Finally, he advises businesses to segment data that they are no longer using. “Far too often I see organizations storing years’ worth of records in a single database and not deleting old files,” Fowler said. “As a general rule, it is a good strategy to securely back up old data to limit the exposure in the event of a data incident.”
