Our club (CROC) has had two meets this year, using Sporteering with QR codes. At both, an unknown person illicitly acquired the QR codes and entered the event (open to members only and with online registration) under a "joke" name.
Sporteering asks for your birthdate when you register to use the app and that represents a possible security problem as that information is confidential. We've warned members to give Sporteering a false birthday and omit all unneeded information.
The sad part is the hacker is someone related to orienteering.