TL;DR
A security lapse in a Japanese hotel check-in system exposed over one million customer documents online. The data is now offline after TechCrunch alerted the company. The incident highlights ongoing cybersecurity risks from misconfigurations.
A Japanese hotel check-in system called Tabiq, operated by Reqrea, exposed over one million passports, driver’s licenses, and selfie verification photos online due to a security misconfiguration. The data is now offline after TechCrunch alerted the company, marking a significant cybersecurity lapse that could impact thousands of international travelers.
Independent security researcher Anurag Sen discovered that Reqrea had set its Amazon cloud storage bucket, used to store guest data, to be publicly accessible. This allowed anyone with knowledge of the bucket name, ‘tabiq,’ to view sensitive documents without authentication. The exposed data included identity documents from guests worldwide, dating back to early 2020, and was accessible until the company secured the bucket following TechCrunch’s intervention.
Reqrea confirmed that the data was made accessible due to a misconfiguration, and the company has since taken steps to lock down the storage. The firm is conducting an internal review with external legal counsel to determine the full scope of the exposure. It remains unclear whether any unauthorized access occurred before the data was secured, as the company is reviewing its logs. The incident was also documented by GrayHatWarfare, a database that indexes publicly visible cloud storage, confirming the extent of the leak.
Why It Matters
This incident underscores the persistent cybersecurity risks posed by human error and misconfigurations, especially in systems handling sensitive personal data. It highlights the importance of proper cloud security practices, particularly for companies managing personal identification documents. The exposure of such data increases risks of identity theft and fraud, especially as governments and private sectors rely more on digital identity verification processes.
2 Pack Passport Cover With Card Slots RFID Blocking-White&Black
- Multi-Purpose Design: Vaccine and passport holder with card slots
- RFID Blocking: Protects personal information from theft
- Travel Convenience: Holds passport, vaccine card, cards, and cash
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background
This is not the first incident involving sensitive personal data being exposed due to security lapses. Earlier this year, TechCrunch reported on the leak of driver’s licenses and passports from the money transfer app Duc, and last year, Hertz experienced a breach that compromised the driver’s license data of over 100,000 customers. These incidents occur amid rising use of digital verification processes, which are increasingly targeted by cyber threats. Amazon’s cloud platform has taken steps to prevent such misconfigurations, but human error remains a common vulnerability.
“The data was accessible to anyone with just the bucket name, which is a serious security oversight.”
— Anurag Sen, security researcher
“We are conducting a thorough review with external legal counsel to determine the full scope of exposure.”
— Masataka Hashimoto, Reqrea director
SaiTech IT 5 Pack RFID Blocking Card for Credit Debit ID Card, Black
- RFID Blocking Protection: Prevents identity and financial theft
- Jamming Chip Technology: Creates effective RFID signal jamming
- Battery-Free Design: Lifetime use without batteries
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Remains Unclear
It is still unclear whether any malicious actors accessed or downloaded the data before it was secured. The company is reviewing logs to determine if there was any unauthorized access prior to lockdown. The full extent of affected individuals has not yet been disclosed, and the timeline of the exposure remains uncertain.
USB Card Reader Adapter for Secure Digital Identity Verification Supports SD SIM and Cards Compact Plug and Play Design
- Wide Compatibility: Supports multiple operating systems and card types
- Versatile Applications: Ideal for banking, government, and secure transactions
- User-Friendly Design: Flat, ergonomic design for easy card insertion
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What’s Next
Reqrea is expected to notify affected individuals once its investigation concludes. The company will likely implement additional security measures to prevent future misconfigurations. Regulatory authorities may also scrutinize the incident, potentially leading to further investigation or penalties.
DocSafe Fireproof File Organizer with Lock, Hard-Shell Case Fireproof Document Box with 13 Pocket Accordion File Folder, Portable Home Office Travel Safe Storage for Important Documents Laptop Black
- Fireproof and Water-Resistant: Protects against fire, floods, and moisture
- Hard-Shell Durable Design: Provides robust protection and sleek appearance
- Large Capacity Storage: 13 pockets, multiple compartments for organization
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
How did the data leak happen?
The leak occurred because the company’s Amazon cloud storage bucket was misconfigured to be publicly accessible, allowing anyone to view the stored documents without authentication.
What types of documents were exposed?
The exposed documents included passports, driver’s licenses, and selfie verification photos of hotel guests from around the world.
Are the affected individuals at risk now?
Potential risks include identity theft and fraud, but there is no evidence that malicious actors accessed the data before it was secured. The company is investigating further.
Has the data been secured now?
Yes, the company has locked down the cloud storage bucket following the discovery and alert from TechCrunch.
Will the company notify those affected?
Reqrea has stated it plans to notify affected individuals once its investigation is complete.
