Analysis | How a NATO Strike Group Was Accidentally Tracked in the Mediterranean

Two incidents disclosed less than a month apart point to the same operational picture: both the French aircraft carrier Charles de Gaulle and the Dutch frigate HNLMS Evertsen were exposed during the same broader deployment of a French strike group in the eastern Mediterranean. In the French case, the exposure came via the fitness app Strava; in the Dutch case, through a Bluetooth tag concealed in a postcard sent through military mail. In both instances, published or leaked information enabled tracking of naval assets operating in the same area and under the same task force.

According to Le Monde, on March 13, 2026, a French officer recorded a 7-kilometer run on Strava in 35 minutes while aboard a vessel belonging to the strike group centered around Charles de Gaulle. Because the profile was public, the newspaper was able to place the carrier and its escort group in near real time northwest of Cyprus, about 100 kilometers from the Turkish coast. Le Monde corroborated the identification using satellite imagery, which reportedly captured the carrier’s silhouette shortly after the activity was posted.

Several weeks later, The Register reported that journalists were able to track the frigate HNLMS Evertsen after concealing a Bluetooth tag inside a postcard sent to the ship via military postal services. The tag reportedly remained active for around 24 hours, showing the vessel leaving Heraklion in Crete, sailing along the island, and then heading east toward Cyprus. The signal disappeared near Cyprus after Dutch defense officials reportedly detected and disabled the device during mail screening.

The connection between the two incidents is not only geographical but operational. The Dutch government confirmed in March 2026 that Evertsen had been deployed to the eastern Mediterranean to protect the French carrier strike group, meaning both exposures related to the same active naval task force—once through personal digital activity by a French crew member, and once through a physical object inserted into the supply chain of a Dutch escort vessel.

According to The Register, the Dutch Ministry of Defence publicly publishes detailed guidelines for sending mail and parcels to deployed personnel, which were used to facilitate the postcard experiment. Following the incident, the ministry announced changes to its mail policy, including restrictions on greeting cards containing batteries. In France, the armed forces general staff told Le Monde that posting routes on Strava “does not comply with existing guidelines,” and emphasized that digital hygiene rules are part of mandatory pre-deployment briefings.

The French case also fits a broader pattern. Le Monde reported that earlier “StravaLeaks” investigations had exposed the locations of security personnel for the presidents of France, the United States, and Russia, and that in January 2025 even crews of France’s strategic nuclear submarines had inadvertently revealed patrol schedules through fitness tracking data. In those cases, the navy described the incidents as “individual negligence.”

Taken together, the two recent cases highlight how the same military deployment can be exposed from two entirely different vectors: voluntary digital footprint data and seemingly harmless physical objects entering military logistics systems. In both instances, no cyber intrusion into military systems was reported—only the exploitation of publicly available data, commercial technology, and open procedures to reconstruct real-time naval movements.