Hotel check-in system exposes over 1 million guest IDs in misconfigured cloud bucket
A hotel check-in system operated by Japan-based startup Reqrea left over 1 million guest passports, driver's licenses and facial verification photos exposed on a misconfigured Amazon cloud storage bucket for years. Security researcher Anurag Sen discovered the publicly accessible data, which was secured after TechCrunch contacted the company and Japan's cybersecurity authority.
What happened
The Tabiq hotel check-in system, maintained by Japan-based startup Reqrea, left more than 1 million customer passports, driver's licenses, and facial verification selfies publicly accessible on an Amazon cloud storage bucket. Independent security researcher Anurag Sen discovered the exposed bucket named 'tabiq' could be viewed by anyone using a web browser without authentication or password by knowing only the bucket name.
The data stretched back to early 2020 and included documents from hotel guests from dozens of countries. Sen alerted TechCrunch, which contacted both Reqrea and Japan's cybersecurity coordination team JPCERT. Reqrea locked down the storage bucket after TechCrunch reached out to the company.
Reported impact
Guests face heightened identity theft risks from the exposed personal identification documents. Reqrea director Masataka Hashimoto said the company does not know how the storage bucket became public and is conducting an investigation to determine the full scope of exposure and whether anyone other than Sen accessed the data.
Index analysis
By default, Amazon's cloud storage buckets are private, and Amazon added multiple warning prompts to users before data can be made public. After TechCrunch alerted the company, Reqrea said it plans to notify affected individuals once it has completed its investigation.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.