Loading story…
Reqrea, the Japan-based operator of the Tabiq hotel check-in platform, exposed sensitive identity documents for more than 1 million hotel guests after an Amazon cloud storage bucket named tabiq was left publicly accessible without authentication. The exposed files reportedly included passports, driver’s licenses, and selfie verification images used for facial-recognition-based hotel check-in, with records spanning from early 2020 through May 2026 and affecting guests from multiple countries.
Security researcher Anurag Sen discovered the exposure and alerted TechCrunch, which then notified Reqrea and Japan’s JPCERT; the bucket was secured after disclosure. Reqrea said it is investigating how the bucket became public, reviewing logs to determine whether unauthorized parties accessed the data, and plans to notify affected users once the scope of the incident is confirmed. The incident appears tied to a basic cloud misconfiguration rather than a sophisticated intrusion.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
Reqrea said it is reviewing logs to determine the full scope of the exposure and whether anyone other than the researcher accessed the data. The company also said it plans to notify affected individuals once its investigation is complete.
Following notification, Reqrea restricted access to the misconfigured Amazon bucket, ending public exposure of the guest identity records. The company said it was still investigating how the bucket became public and whether any unauthorized access occurred.
After Sen's discovery, TechCrunch contacted Reqrea and Japan's JPCERT to report the publicly accessible bucket and the sensitive guest data exposure. This disclosure prompted the company to respond to the incident.
Independent researcher Anurag Sen found that Reqrea's Amazon cloud storage bucket named "tabiq" was publicly accessible without authentication, exposing more than one million customer identity records. The exposed data affected hotel guests from multiple countries using the Japan-based Tabiq check-in platform.
Files in Reqrea's publicly exposed Amazon S3 bucket dated back to early 2020, indicating the Tabiq hotel check-in platform had been storing sensitive guest identity documents there from at least that time. The data included passports, driver's licenses, and selfie verification images used for hotel check-in.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizers of **Abu Dhabi Finance Week (ADFW)** inadvertently exposed sensitive identity documents for roughly **700 attendees** after an associated **cloud storage server was left publicly accessible**. Reporting indicated the exposed files included **passport scans, national ID cards, and other personally identifiable information**, affecting high-profile individuals such as former UK Prime Minister **David Cameron** and other global finance and government figures. An independent security researcher reportedly discovered the dataset using common cloud-scanning tools, and the data may have been accessible for **at least two months** before being addressed. The incident underscores ongoing risk from **misconfigured or unsecured cloud storage** supporting major events and third-party registration workflows, where large volumes of identity documents are collected and retained. Other items in the provided set cover unrelated topics (post-quantum planning, phishing kits, supply-chain malware on Android devices, and general security roundups/advice) and do not add material facts about the ADFW exposure.
Jul 12, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026