Misconfigured Cloud Storage Exposes Over 1 Million IDs from Tabiq Hotel System

Securityaffairs.Co

Misconfigured Cloud Storage Exposes Over 1 Million IDs from Tabiq Hotel System

First seen 18 May 2026, 13:48 UTC • •64.5

Article Content

1 / 3

Browse articles

ThreatCluster •May 19, 2026 at 13:23 UTC

•Over 1 million sensitive documents were exposed due to a misconfigured cloud storage bucket.
•The data leak was discovered by an independent researcher and reported to TechCrunch.
•Reqrea has secured the exposed data and is conducting an investigation into the incident.

A misconfigured Amazon cloud storage bucket exposed over one million passports, driver's licenses, and selfies from the Tabiq hotel check-in system, maintained by Reqrea, a Japanese startup. The data was publicly accessible due to the bucket being set to open access, allowing anyone to view the sensitive documents without authentication. Independent researcher Anurag Sen discovered the leak and alerted TechCrunch, which subsequently notified Reqrea and Japan's cybersecurity team, JPCERT. The exposed data included identity documents dating back to early 2020. Reqrea has since secured the bucket and is investigating the incident to assess the scope of exposure and determine if unauthorized access occurred. The company plans to notify affected individuals once the investigation is complete. This incident highlights ongoing issues with basic cybersecurity practices leading to significant data exposure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 125d ago How this analysis works

Timeline

2026-05-15

TechCrunch reports data exposure

TechCrunch published an article detailing the exposure of over 1 million sensitive documents from Tabiq due to a misconfigured cloud storage bucket.

2026-05-15

Reqrea secures the storage bucket

After being notified by TechCrunch, Reqrea secured the misconfigured Amazon storage bucket to prevent further access to the exposed data.

2026-05-18

Security Affairs reports on the incident

Security Affairs published an article summarizing the exposure and its implications for cybersecurity practices.

Securityaffairs.Co

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Organization (4)

Duc App
Hertz
Reqrea
Tabiq

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Relationships

Data Breach related to Duc App
Data Breach related to Hertz
Data Breach related to Reqrea
Data Breach related to Tabiq
Data Breach related to CWE-200 - Exposure of Sensitive Information

Following this threat?

Track Duc App in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…