Hotel Check-In System Exposes Over a Million Passports and Driver's Licenses Due to Security Lapse
A significant security lapse in a hotel check-in system, Tabiq, operated by Japan-based tech startup Reqrea, exposed over a million customer passports, driver's licenses, and selfie verification photos to the public web. The breach was discovered by independent security researcher Anurag Sen, who found that the system's Amazon cloud-hosted storage bucket was set to be publicly accessible. This allowed anyone with the bucket name 'tabiq' to access the sensitive data without a password. After being alerted by TechCrunch, Reqrea secured the storage bucket and is currently investigating the extent of the exposure with the help of external legal counsel. The exposed data included identity documents from visitors worldwide, dating back to early 2020. This incident highlights the ongoing issue of companies failing to adhere to basic cybersecurity practices, leading to the exposure of sensitive customer information.