Tabiq hotel check-in exposure affects 1,060,338 guests’ identity documents, signatures and photos
Reqrea’s Tabiq hotel check-in service exposed guests’ identity documents and photos through public cloud storage. Access is blocked; theft remains unconfirmed. Ask whether you were affected and beware messages requesting passwords or money.
If you checked in through Tabiq, ask Reqrea at [email protected] whether your images were affected. Treat unexpected messages claiming to come from Reqrea, your hotel or a public authority cautiously: Reqrea says it will not request passwords or money over this incident. There is no device update to install.
What’s happening
A publicly accessible Amazon S3 storage bucket used by Reqrea’s Tabiq hotel check-in service exposed more than one million identity documents and selfie verification photographs belonging to international hotel guests. Researcher Anurag Sen discovered the exposure; Reqrea secured the storage after notification. The company later put the affected population at 1,060,338 people, covering images collected from 20 January 2020 to 14 May 2026. These included faces, signatures, passports and driving licences; reservation and credit card information were excluded. The dates describe when information was collected, not a confirmed exposure period. Reqrea’s September update said security improvements were largely complete by July and its investigation had not confirmed theft or misuse. Access by anyone beyond the researcher remains unconfirmed. June’s notice said individual notifications were being prepared; the later statement did not confirm their completion.
- What
- Breach
- Affects
- Reqrea Tabiq hotel check-in service
- Fixed in
- Nothing to patch
- Since
- 15 May 2026
- Closed
- 17 Sept 2026
Timeline
- Update
Reqrea said security improvements were largely complete by July. Its independent investigation had not confirmed external leakage, unlawful acquisition or misuse of the images.
- Update
Reqrea identified 1,060,338 affected people whose images were collected between 20 January 2020 and 14 May 2026. Individual notifications were being prepared.
- Update
Reqrea submitted its final report to Japan’s Personal Information Protection Commission, following an initial report on 18 May.
- Made public
TechCrunch publicly reported the exposure.
- UpdateNothing to patch
According to Reqrea’s June notice, it blocked external access. Its September notice describes containment as completed by 15 May.
- Update
Reqrea discovered that images held by its Tabiq hotel check-in service were accessible from outside the company.
Sources
- Apology and report concerning possible personal information leakage in the hotel check-in systemReqrea · 17 Sept 2026
- Notice and apology concerning the handling of personal information in TabiqReqrea · 30 June 2026
- A hotel check-in system left a million passports and driver's licenses open for anyone to seeTechCrunch · 15 May 2026
- Public Amazon bucket leaks sensitive guest data from Japanese hotel platform TabiqSecurity Affairs · 18 May 2026
- NewsBites Volume XXVIII, Issue 38SANS · 19 May 2026