A hotel check-in system left a million passports and driver’s licenses open for anyone to see | TechCrunch
A security lapse in the Tabiq hotel check-in system left sensitive customer documents and verification photos accessible on the open web without a password
A security lapse in a hotel check-in system resulted in the exposure of more than one million sensitive customer documents to the open web. The data included passports, driver's licenses, and selfie verification photos, which were accessible to anyone without the need for a password. This vulnerability was caused by the tech company setting its cloud storage to public, leaving the information unprotected and available for public viewing.[1][2]
The system involved in the breach is called Tabiq, which is developed and maintained by the Japan-based technology startup Reqrea. According to the company's website, Tabiq is used by hotels to process guest identification and streamline the check-in process. This specific security lapse occurred because the company's cloud storage was configured as public, allowing the records to be accessed and viewed by anyone on the internet.[1][2]
The exposed data is no longer accessible after TechCrunch discovered the lapse and alerted the company responsible. Following the notification, Reqrea took the necessary steps to move the information offline and secure the cloud storage. The breach included more than one million passports and driver's licenses, along with selfie photos used for identity verification, all of which were previously open to the web.[1][2]
