A Million Hotel Guests' Passports Left Exposed Online—No Hack Required

A Japanese startup left more than one million hotel guests' passports, driver's licenses, and facial verification photos exposed on the public internet. No sophisticated hacking was needed. Just one misconfigured Amazon cloud storage bucket, and the data sat open for years.

The system, called Tabiq, was built by the company Reqrea. It helps hotels in Japan streamline check-ins by scanning guests' government IDs and using facial recognition. Travelers upload their documents, the platform matches faces to photos, and then stores everything. An independent researcher spotted the exposed data last week.

Anurag Sen found the bucket, named simply “tabiq,” with no password or authentication required. Anyone who knew the name could browse files dating back to early 2020. Passports, driver's licenses, and selfies from visitors across dozens of countries were all there for the taking.

Sen alerted TechCrunch instead of going public. The publication contacted Reqrea and Japan's cybersecurity center, JPCERT. Within hours, the bucket was locked down. But the data had been exposed for years.

Reqrea director Masataka Hashimoto acknowledged the breach in an email, stating the company is reviewing the incident with legal counsel and external advisors. He said Reqrea does not know how the bucket became public. Amazon sets buckets to private by default and includes multiple warnings before users can make them public. Yet the error happened anyway.

The company plans to notify affected guests once its investigation is complete. They are checking access logs to see if anyone else viewed the files before Sen's discovery. Those answers matter because this incident is not an isolated case.

Travel companies hold vast amounts of sensitive identity data, often through networks of partners and vendors. That structure creates repeated weak points. Earlier this year, a money-transfer app called Duc exposed customer driver's licenses and passports through similar cloud storage mistakes. Hertz suffered a breach last year that let hackers walk away with at least 100,000 customers' license details.

Booking.com also faced trouble in April when unauthorized parties accessed reservation data, including names, addresses, and private messages with hotels. The travel sector's reliance on third-party tools turns each vendor into a potential entry point.

The Tabiq case fits a larger pattern. Governments push age-verification and know-your-customer rules. Businesses respond by collecting high-resolution copies of official documents. Many hand that responsibility to startups promising fast check-ins. The convenience sells, but security assumptions rarely get tested until something breaks.

Security experts have warned about cloud misconfigurations for years. Databases indexed by services like GrayHatWarfare regularly catalog open buckets. Tabiq's appeared there too. The exposure was discoverable by anyone running routine scans.

The consequences stretch beyond embarrassment. Exposed passports enable identity theft. Fraudsters can open accounts, cross borders, or build synthetic identities. Selfies add biometric risk. Once a face is paired with a name and document number, deepfake creation becomes simpler.

Japan's hotels using Tabiq must now answer guest questions. So must Reqrea. The company has engaged legal counsel and is reviewing logs. But the delay in alerting individuals raises compliance questions under strict breach-notification rules like GDPR, which demand prompt disclosure for high-risk incidents.

Hashimoto's statement leaves details unresolved: How did the bucket flip to public? Were access controls ever tested? Did the company conduct regular audits? Those answers may surface in the final report. For now, the focus remains on containment and notification.

The incident also highlights tension around facial-recognition in hospitality. Proponents say it reduces fraud and speeds service. Critics point to the permanent record created when every guest's likeness is stored alongside official IDs. A single error turns that record into a liability for millions.

Travelers face practical choices: limit shared data, ask hotels what third-party systems handle their documents, and monitor credit reports after any known exposure. Yet many have little leverage when a booking platform or hotel vendor demands scans.

Reqrea built Tabiq to solve a real operational problem. Contactless check-in gained traction during the pandemic and never fully receded. The question now is whether the industry will treat data protection with matching seriousness.

Because basic errors should not expose a million identity documents in 2026. The tools exist to prevent it. The warnings are loud. Yet the bucket stood open. Anyone could look. That fact alone demands closer scrutiny of every vendor touching guest IDs.