A hotel check-in system left a million passports and driver’s licenses open for anyone to see
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Reqrea operates the Tabiq hotel check‑in system that stores guests’ passports, driver’s licenses and selfie photos on Amazon cloud storage.
- Anurag Sen discovered that the Amazon cloud storage bucket named “tabiq” was publicly accessible, exposing over 1 million identity documents from early 2020 to this month.
- TechCrunch alerted both Reqrea and Japan’s cyber‑security coordination team JPCERT, prompting the company to lock down the bucket and start a forensic review.
- GrayHatWarfare indexed the exposed bucket, confirming that files from worldwide guests were searchable without authentication.
- Reqrea says it will notify affected individuals after completing its investigation and is reviewing logs for any prior unauthorized access.
Why it matters: Hotel guests lose privacy for over a million identity documents, while Reqrea faces regulatory scrutiny and potential lawsuits; the breach forces the firm to notify victims and tighten its cloud‑security practices.
