2026 Duc App (Duales) — open Amazon bucket exposed customer passports and driver’s licenses
Data compromised
Driver’s licenses, passports, selfies uploaded for KYC on Canadian money-transfer app
Technical writeup
Toronto-based Duales left an Amazon-hosted storage bucket publicly open, allowing unauthenticated access to customer-uploaded driver’s licenses, passports, and selfies collected by its Duc App money-transfer service (100K+ Play Store downloads). TechCrunch reported folders each containing tens of thousands of files; a precise denominator was not attested. The bucket exposure was verified by TechCrunch sampling; BreachHistory leaves `recordsAffected` at zero pending a company or regulator count.
Root cause
Publicly accessible Amazon S3 storage (misconfiguration)