{"id":"tabiq-hotel-identity-exposure-may-2026","category":"breach","status":"closed","title":"Tabiq hotel check-in exposure affects 1,060,338 guests’ identity documents, signatures and photos","tldr":"Reqrea’s Tabiq hotel check-in service exposed guests’ identity documents and photos through public cloud storage. Access is blocked; theft remains unconfirmed. Ask whether you were affected and beware messages requesting passwords or money.","summary":"A publicly accessible Amazon S3 storage bucket used by Reqrea’s Tabiq hotel check-in service exposed more than one million identity documents and selfie verification photographs belonging to international hotel guests. Researcher Anurag Sen discovered the exposure; Reqrea secured the storage after notification. The company later put the affected population at 1,060,338 people, covering images collected from 20 January 2020 to 14 May 2026. These included faces, signatures, passports and driving licences; reservation and credit card information were excluded. The dates describe when information was collected, not a confirmed exposure period. Reqrea’s September update said security improvements were largely complete by July and its investigation had not confirmed theft or misuse. Access by anyone beyond the researcher remains unconfirmed. June’s notice said individual notifications were being prepared; the later statement did not confirm their completion.","action":"If you checked in through Tabiq, ask Reqrea at irc@tabiq.jp whether your images were affected. Treat unexpected messages claiming to come from Reqrea, your hotel or a public authority cautiously: Reqrea says it will not request passwords or money over this incident. There is no device update to install.","product":"Reqrea Tabiq hotel check-in service","audience":"home","severity":"high","patch":"na","exploited":false,"cves":[],"tags":["reqrea","tabiq","data-breach","identity-documents","cloud-storage","hotels"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Apology and report concerning possible personal information leakage in the hotel check-in system","url":"https://reqrea.co.jp/news/cuylx1hp8us/","by":"Reqrea","date":"2026-09-17"},{"kind":"advisory","title":"Notice and apology concerning the handling of personal information in Tabiq","url":"https://reqrea.co.jp/news/zb7qsrkz-vjv/","by":"Reqrea","date":"2026-06-30"},{"kind":"news","title":"A hotel check-in system left a million passports and driver's licenses open for anyone to see","url":"https://techcrunch.com/2026/05/15/a-hotel-check-in-system-left-a-million-passports-and-drivers-licenses-open-for-anyone-to-see/","by":"TechCrunch","date":"2026-05-15"},{"kind":"news","title":"Public Amazon bucket leaks sensitive guest data from Japanese hotel platform Tabiq","url":"https://securityaffairs.com/192302/data-breach/public-amazon-bucket-leaks-sensitive-guest-data-from-japanese-hotel-platform-tabiq.html","by":"Security Affairs","date":"2026-05-18"},{"kind":"news","title":"NewsBites Volume XXVIII, Issue 38","url":"https://www.sans.org/newsletters/newsbites/xxviii-38","by":"SANS","date":"2026-05-19"}],"started":"2026-05-15","closed":"2026-09-17","created":"2026-11-03T20:36:05.665Z","updated":"2026-11-03T20:36:05.665Z","cve_notes":[],"timeline":[{"at":"2026-09-17","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Reqrea said security improvements were largely complete by July. Its independent investigation had not confirmed external leakage, unlawful acquisition or misuse of the images.","url":"https://reqrea.co.jp/news/cuylx1hp8us/","by":"Reqrea","patch":null},{"at":"2026-06-30","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Reqrea identified 1,060,338 affected people whose images were collected between 20 January 2020 and 14 May 2026. Individual notifications were being prepared.","url":"https://reqrea.co.jp/news/zb7qsrkz-vjv/","by":"Reqrea","patch":null},{"at":"2026-06-12","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Reqrea submitted its final report to Japan’s Personal Information Protection Commission, following an initial report on 18 May.","url":"https://reqrea.co.jp/news/zb7qsrkz-vjv/","by":"Reqrea","patch":null},{"at":"2026-05-15","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"TechCrunch publicly reported the exposure.","url":"https://techcrunch.com/2026/05/15/a-hotel-check-in-system-left-a-million-passports-and-drivers-licenses-open-for-anyone-to-see/","by":"TechCrunch","patch":null},{"at":"2026-05-14","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"According to Reqrea’s June notice, it blocked external access. Its September notice describes containment as completed by 15 May.","url":"https://reqrea.co.jp/news/zb7qsrkz-vjv/","by":"Reqrea","patch":"na"},{"at":"2026-05-13","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Reqrea discovered that images held by its Tabiq hotel check-in service were accessible from outside the company.","url":"https://reqrea.co.jp/news/zb7qsrkz-vjv/","by":"Reqrea","patch":null}],"url":"https://hard.fyi/live/tabiq-hotel-identity-exposure-may-2026/","json":"https://hard.fyi/api/live?id=tabiq-hotel-identity-exposure-may-2026"}