Top money transfer site Duc leaks user passport and driving license data info online

Date:
Fri, 03 Apr 2026 14:20:00 +0000

Description:
Hundreds of thousands of KYC files were exposed in attack on Duc.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Duc app exposed 360,000 unencrypted customer files Data included IDs, addresses, and transaction details Database secured after researcher alerted company Duc App, a Canadian money transfer service provider, was leaking sensitive customer data to the wide web, allowing
anyone with an internet connection and a browser to access it.

Security researcher Anurag Sen from CyPeace recently discovered a publicly accessible Amazon -hosted storage server with sensitive data on hundreds of thousands of people. This included peoples names, home addresses, but also
the dates, times, and details of their transactions. They also contained drivers licenses, passports, and other documents collected during the Know Your Customer (KYC) registration process. Article continues below You may
like Top photo ID apps leak user data - over 150,000 thought to have been affected Top Abu Dhabi finance summit exposes personal data, passport info of hundreds of major global figures Top Android AI photo and video editor
exposes nearly two million user images and videos Locking down the database Sen said the server listed more than 360,000 files, all in unencrypted format and available to anyone who knew where to look. After making the discovery, Sen reached out to TechCrunch to help contact Duc Apps owners, a company called Duales.

The publication managed to contact the owners, who locked the database down, soon after. TechCrunch said it could not confirm the number of exposed
drivers licenses and passports, but said it saw several folders with tens of thousands of user-uploaded files, dating back from September 2020, and being uploaded daily.

In an email statement shared with the publication, Duales chief executive officer Martinez Gonzlez said the data was stored on a staging site - meaning the website was used mostly for testing. However, he did not explain why the database was publicly accessible.

All protections are in place, Martinez Gonzlez said. We are notifying the appropriate parties. We have not contracted any services from you. We dont know if any malicious third parties managed to find the database before Sen, but it is always possible. Cybercriminals frequently scan the wider web for exposed databases such as this one. Are you a pro? Subscribe to our
newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Generally, cloud misconfigurations are the number one cause of data leaks and spills, resulting mostly from the misconception that cloud security is primarily the service providers responsibility. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/top-money-transfer-site-duc-leaks-user- passport-and-driving-license-data-info-online


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)