Sticky-note security turned gym into hall of '80s horrors

A gym equipment installer left a default admin PIN on a Post-it note attached to a treadmill, allowing a hotel guest to hijack the fitness machine's screen and play 80s music videos. The incident highlights IoT security risks in unexpected places. The installer has since adopted better practices: isolating devices on a guest VLAN, changing default passwords, disabling USB ports, patching firmware during burn-in, and locking network ports. A Forrester analyst recommends also restricting outbound firewall access to only necessary services, preventing compromised fitness machines from being used in broader attacks.