According to fuitededonnées.fr, citing Dutch outlet Follow the Money, travel app Polarsteps left data of 23 million users accessible, including about 904,000 Belgians [1]. The app's API was unprotected, letting journalists retrieve names, photos, GPS positions and some home addresses and trips, and the Dutch defence ministry blacklisted the app; the company says no passwords were stolen [1]. fuitededonnées.fr advises deleting the app and requesting account deletion if unused, and not posting live photos or locations or announcing departures while travelling [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Sep 8, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Dutch travel app Polarsteps left API unprotected, exposing 23 million users' locations and photos
1 min read
- Disclosed
- Sep 8, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 23,000,000 people[1]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology
Timeline
- Flaw revealed by media[1]
Technical details
Remediation
Vendor guidance
- 1Delete account; stop live sharing mitigate[1]
Delete unused accounts and stop posting live locations while travelling.
References
Media1
- [1]fuitededonnées.fr2026-09-08Accessed 2026-11-11Snapshot 2026-11-11 sha256 ccaf529dbfd2
“L'application de voyage Polarsteps a laissé accessibles les données de 23 millions d'utilisateurs, dont environ 904 000 Belges, selon le média néerlandais Follow the Money (FTM), qui a révélé la faille début septembre 2026.”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.