Tabiq Hotel Platform Leaks 1 Million Passports and IDs via AWS S3

A critical misconfiguration in the Reqrea’s Tabiq hotel check-in system has exposed over one million sensitive guest documents, including passports, driver’s licenses, and selfie verification photos. According to Security Affairs, the data was left publicly accessible in an Amazon S3 cloud storage bucket. Anyone with knowledge of the bucket name, “tabiq,” could access this data without authentication.

Security Affairs reports that cybersecurity researcher Anurag Sen discovered the exposure, which spanned from early 2020 until recently, affecting hotel guests worldwide. Following notification to Reqrea and Japan’s JPCERT, the bucket was secured. Reqrea states that Amazon S3 buckets are private by default and is investigating how the public exposure occurred, with plans to notify affected users after a full review.

This isn’t just a simple slip-up; it’s a fundamental failure in cloud security posture. Leaving a bucket publicly readable, especially one containing identity documents, is inexcusable. Attackers don’t need sophisticated exploits when basic configuration errors hand them the keys to the kingdom.