Millions Of Hotel Guests' IDs Left Open Online In Massive Security Blunder

A major security lapse at a hotel check-in technology company exposed more than one million passports, driving licences and selfie verification photos online without password protection, according to a report by TechCrunch. The exposed records belonged to guests who used a digital hotel check-in platform called Tabiq, operated by Japan-based startup Reqrea. The system is used by several hotels across Japan and relies on facial recognition and document scanning technology to verify guests during check-in.

The breach was discovered by independent security researcher Anurag Sen, who found that the company had accidentally left one of its Amazon cloud storage buckets publicly accessible. This meant anyone with the correct web address could view highly sensitive identity documents without needing a password or special access.

According to the report, the exposed data included passports, driving licences and facial verification selfies uploaded by hotel guests from around the world. Such documents typically contain names, addresses, dates of birth, passport numbers and photographs, raising serious concerns about identity theft and fraud.

TechCrunch said the data was secured after the company was alerted to the issue. However, it remains unclear how long the files were exposed online or whether unknown parties may have accessed them before the system was locked down.

Cybersecurity experts have long warned about the dangers of improperly configured cloud storage systems, often known as “open bucket” exposures. These incidents happen when companies fail to apply basic security settings to online databases.

The leak has also renewed concerns over the growing use of facial recognition and digital identity systems in the hospitality industry, where hotels increasingly collect sensitive personal data to speed up contactless check-ins.

The incident comes amid rising scrutiny of companies handling personal identity documents, especially as governments and businesses continue expanding digital verification systems worldwide.