InfoSecBulletin Cybersecurity for mankind
Security researcher Jeremiah Fowler discovered a database containing sensitive information from gym customers and staff, including names, financial details, and possible phone call, left unencrypted and unprotected. Jeremiah Fowler claims he discovered the wide-open AWS repository managed by HelloGym in late July.
The database was open for a week, and Fowler noted that identifying who managed the audio call repository required some effort.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
“It was only after calling, asking individual gyms that mentioned their locations in the recording,” he told The Register. “I asked who they use to record their calls and one of the managers finally told me.”
HelloGym offers sales, marketing, phone-answering, and VoIP services for major gyms like Anytime Fitness, Snap Fitness, and UFC Gym. Their database includes 1.6 million audio files from various franchise locations of leading fitness brands in the US and Canada.
HelloGym declined to comment for this story, the register reported.
The MP3 audio recordings include people’s names, phone numbers, and reasons for the calls, like renewing or canceling memberships. They were collected between 2020 and 2025, based on file dates and timestamps. According to Fowler, the database was likely a storage repository for VoIP audio files intended for internal use only.
“A very large number of the recordings referenced payment and billing issues,” Fowler said. “Although I didn’t hear any credit card numbers in the audio, it shows that members were comfortable discussing payment information over the phone.”
Intercepting the call, pretending to be a gym employee, and tricking the member into sharing payment information or paying a fake fee – and then stealing their credit card or bank account details.
The audio files could be played in any web browser without requiring specialized software or a password to listen to them. Fowler advises using encryption to protect files from being easily readable if exposed. He also recommends penetration testing to find misconfigured or open storage systems.
Finally, he advises businesses to segment data that they are no longer using. “Far too often I see organizations storing years’ worth of records in a single database and not deleting old files,” Fowler said. “As a general rule, it is a good strategy to securely back up old data to limit the exposure in the event of a data incident.”
