A publicly exposed database, without password protection or encryption, was discovered by Cybersecurity Researcher Jeremiah Fowler and contained 1.6 million audio files. These audio files included phone calls and voice messages collected between 2020 and 2025, belonging to a range of gyms and fitness centers across the United States and Canada. However, the database itself appears to belong to Hello Gym, a third-party contractor.
Fowler informed the contractor of the exposure, and within hours, the database was restricted. It is unknown how long the database was up or if it was accessed by malicious actors.
Many exposed audio recordings contained personally identifiable information (PII) such as names and phone numbers. If such information was leaked to a malicious actor, it could leave individuals at risk of targeted spear-phishing or social engineering campaigns. Fowler also noted the potential for a “man-in-the-middle” attack, in which a malicious actor could call a target, impersonate gym or health facility staff, and convince the target to share their credit or debit card information.
In one exposed audio sample, Fowler discovered a call in which a gym manager spoke with a security monitoring service regarding the establishment’s alarm system, sharing information such as name, location and password credentials. If accessed by a threat actor, this data could be leveraged to physically access the gym after hours.
Another notable risk is the potential for AI voice cloning. Fowler states, “The fact that AI models are capable of cloning voices with a high level of accuracy is terrifying, especially considering that many companies often record our conversations. (We have all called a business or organization and heard the message ‘Your call may be recorded for quality and training purposes.’) In such instances, consumers or clients generally have little or no control over how long those files are kept — not to mention the potential outcomes should these recordings fall into the wrong hands.”