“Jeremiah Fowler told The Register more than 474,000 images of both members and staff – including men, women, and children – were stored in a database that was left unprotected and publicly accessible without the need for a password.”
Total Fitness left 47.7GB of member photos in a database with no password, and Fowler says about 97 percent were member images, including ID documents and bank card details. The gym chain calls the member photos a “subset” and counts only 114 images as identifying. A photo of your face is the identifying part. Total Fitness collected it to stop membership sharing and then shared it with the whole internet.