In July 2020, Russian hackers shut down every Garmin service for five days. Garmin reportedly paid $10 million to a group linked to Evil Corp, sanctioned by the US Treasury. Paying sanctioned entities may violate US law. Garmin never confirmed whether attackers copied user data — years of GPS tracks, home addresses, and daily routes for millions of athletes. They paid the ransom, restored services, and hoped everyone would forget. Whether Russian criminals have your cycling routes remains unanswered. In 2018, a 20-year-old Australian student discovered Strava's heatmap was revealing secret US military bases in Afghanistan — soldiers' fitness trackers drew glowing lines around classified installations. Garmin Edge data feeds identical ecosystems. Your daily commute, weekend rides, coffee stops — they paint a heatmap of your life as detailed as anything that exposed military operations. The difference is soldiers had security clearances and you have a cycling hobby. The data exposure is the same.
What they claim: Garmin says users control their privacy settings and data sharing.
What we found: Garmin Connect defaults rides to public. Routes including start (home) and end (home) are visible to anyone. Segments post timing on public leaderboards. LiveTrack shares real-time GPS via unauthenticated links.
What they claim: Garmin says it doesn't sell user data to third parties.
What we found: Garmin partners with insurance companies and corporate wellness programs where fitness data may be shared. Employer-sponsored Garmin programs give insurers access to heart rate, activity levels, and exercise frequency. Garmin didn't sell your data — your employer bought a program that includes it.
What they claim: Garmin says it protects user data with industry-standard security measures.
What we found: In July 2020, WastedLocker ransomware (linked to sanctioned Russian group Evil Corp) shut down all Garmin services for five days. Garmin reportedly paid $10 million ransom. Never disclosed whether user data — years of GPS tracks and location history — was exfiltrated.
What they claim: Garmin says location data is used to provide fitness and navigation services.
What we found: Garmin Connect stores complete GPS tracks with timestamps. In 2018, Strava's heatmap (built from similar data) revealed US military base locations and patrol patterns in Afghanistan and Syria. Garmin data feeds identical ecosystems. Aggregated route data reveals home, work, commute, and frequented locations.