2026 Reqrea Tabiq — public S3 bucket exposed 1M+ hotel guest passports and IDs (Japan)
Data compromised
Passports, driver’s licenses, selfie verification photos for hotel guests worldwide
Technical writeup
Japan-based startup Reqrea, operator of the Tabiq facial-recognition hotel check-in system used at hotels across Japan, left an Amazon S3 bucket named “tabiq” publicly readable without authentication, exposing more than 1 million customer passports, driver’s licenses, and selfie verification images. Researcher Anurag Sen discovered the lapse; Reqrea secured the bucket after TechCrunch and JPCERT contact and told TechCrunch it plans to notify affected individuals after completing its investigation.
Root cause
Publicly accessible Amazon S3 bucket (cloud misconfiguration)