InfoSecBulletin Cybersecurity for mankind
Nearly 32 million records and about 110 TB of data from Trackman users were left exposed online. This database included user names, email addresses, device information, IP addresses, and security tokens. Security researcher Jeremiah Fowler discovered the vulnerability and reported it to Website Planet, noting that the database lacked password protection for an unknown period. Trackman is a company that provides swing and shot analysis technology for golfers worldwide.
Fowler highlighted several risks associated with exposed data, including sensitive user information that could be exploited in cyberattacks. TrackMan’s technology, used in golf simulators and launch monitors, employs radar and imaging to collect accurate data on ball flight and player movement.
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally
CISA Releases Advisories For 20 Industrial Control Systems (ICS)
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365
CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report
(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor
CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns
Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure
This Adtech Company is Powering Surveillance of U.S. Military Personnel
Intel Patched 374 Vulnerabilities in multiple products
The exposed records contained “session” reports with analytics from TrackMan Performance Studio, a popular performance analysis tool. Major networks like the Golf Channel, BBC, and CNN World rely on TrackMan’s technology to provide real-time data and improved viewing experiences for sports fans.
The exposure of personal data like names and email addresses raises concerns about phishing and social engineering threats, specially for TrackMan’s high-profile athlete clients. Though there’s no indication of actual misuse, the risks remain. The exposed data also included GUIDS and Wi-Fi details. While GUIDs are less sensitive, they can help identify device vulnerabilities. additionally, Wi-Fi and hardware information may be exploited for attacks targeting specific devices, increasing the risk of unauthorized access.
Fowler emphasized the need for sports technology companies like TrackMan to adopt strong security measures for large user data. Essential practices include encryption, multi-factor authentication, regular software updates, and restricted access to sensitive information. He recommends regular security audits to identify vulnerabilities and protect data from unauthorized access.
Although TrackMan did not respond to his notice before publication, Fowler noted that the database was secured shortly after his report. He stated that his investigation aims to raise awareness about data security and does not imply any wrongdoing by TrackMan. He urged companies to proactively protect their data, as public access could pose significant risks to both the company and its users.
(The views shared in this post are solely those of the indivisual contributors and do not necesarily represent the opinions of Infosecbulletin)
