Voicemail Goldmine: A Data Exposure of 1.6M Audio Files Puts Gym Members at Risk

Cybersecurity researcher Jeremiah Fowler has disclosed a data exposure involving more than 1.6 million gym audio recordings, with personal details from internal calls, voicemails, and staff communications leaking across U.S. and Canadian brands.

The recordings, in .mp3 format, were left unencrypted and unpassworded and spanned from 2020 to 2025; Fowler told Website Planet that the database was publicly accessible and not password-protected or encrypted, exposing names, phone numbers, billing issues and membership details. The exposure was traced to a third-party contractor known as Hello Gym, rather than direct calls recorded by the brands themselves.

Fowler warned that criminals could impersonate gym staff to extract payment details, execute fraudulent cancellations, or even bypass physical security systems if alarm credentials were exposed. The incident underscores how overlooked third-party platforms can create serious vulnerabilities, with the potential for AI-powered impersonation and fraud. After disclosure the database was quickly secured, highlighting that even a voicemail database can become a weapon in the digital age.