Observed Signal · Apr 2, 2026 · Data Exposure · Source: techcrunch · Impact: 3/5 · Sentiment: Negative
Duc App Exposed Hundreds of Thousands of ID Documents
A publicly accessible Amazon-hosted storage server containing unencrypted identity documents and personal data collected by the Duc App (owned by Toronto-based Duales) was exposed to the open web. Security researcher Anurag Sen of CyPeace discovered the misconfigured storage server listing over 360,000 files that included driver’s licenses, passports, selfies, and spreadsheets with names, addresses and transaction details. TechCrunch alerted Duales’ CEO Henry Martinez González, after which the files were made inaccessible; a listing of the server contents remained visible. The company said the data was on a "staging site." Canada’s privacy regulator has reached out to Duales for more information. The exposure dated back to September 2020 and the Duc Android app shows over 100,000 downloads on Google Play.
Large-scale exposure of unencrypted identity documents affects user privacy and highlights cloud misconfiguration risks relevant to identity management and data-protection practices across digital platforms.
Track Amazon Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- A public Amazon-hosted storage server contained over 360,000 files tied to the Duc App.
- Exposed data included driver’s licenses, passports, user selfies, and spreadsheets with customer names, home addresses, and transaction details.
- The files were stored unencrypted and were accessible via a simple web address without a password.
- Security researcher Anurag Sen (CyPeace) discovered the exposure and notified TechCrunch; Duales said it resolved the exposure after being contacted.
- Canada’s Office of the Privacy Commissioner has reached out to Duales for more information; Duc App’s Android listing shows over 100,000 downloads.
Connected Companies & Entities
2 Entities mappedRelated Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Hotel check-in system exposed over one million IDs
A Japan-based hotel check-in system called Tabiq, maintained by startup Reqrea, left more than one million passports, driver’s licenses and selfie verification photos publicly accessible after a cloud storage misconfiguration. Independent researcher Anurag Sen discovered the exposed files in an Amazon-hosted storage bucket named "tabiq" and alerted TechCrunch; Reqrea secured the bucket after being notified and engaged external counsel while JPCERT was also contacted. The bucket contained records dating from early 2020 through May 2026 and was indexed by GrayHatWarfare. Reqrea says it is investigating the scope of the exposure and plans to notify affected individuals. The incident highlights recurring risks from cloud misconfigurations in identity-verification and KYC workflows.
Hackers suspected of breaching ID verification service IDScan
Independent security journalist Brian Krebs reported that a dark web identity search site called Nexus is advertising access to more than 150 million driver's licenses and passports from the US and Canada, apparently stolen from a major identity verification company. Krebs identified the likely source as IDScan, a Louisiana-based ID verification service used by major tech and consumer brands. The site claimed to add about 500,000 new documents daily, suggesting near real-time access to the company's systems. Krebs confirmed his own driver's license was in the database, and Defense Secretary Pete Hegseth's photo was also listed. IDScan's COO said the company is investigating, and the FBI's New Orleans field office is probing the breach. Nexus went offline after the report was published.
IDScan confirms data breach of 150 million driver's licenses
Identity verification service IDScan has confirmed a data breach involving the theft of over 150 million driver's license records from its cloud systems. The stolen data includes full names, driver's license numbers, and other government ID numbers such as passports. The breach, which occurred over a year-long hack, was first reported by cybersecurity journalist Brian Krebs. IDScan, based in Louisiana, serves corporate clients including entertainment venues and cannabis dispensaries. The company acknowledged the incident on September 1 after receiving information about a claim of a hack, and its investigation is ongoing. The FBI and Pentagon are reportedly investigating. The stolen database is accessible on the dark web, with searchable records including photos.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.