Breach report
Money-transfer app Duc left customers' licences and passports on an open Amazon server
AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.
Toronto-based Duales stored more than 360,000 customer files, including ID documents and selfies, on a public, unencrypted storage server. Files were locked after TechCrunch alerted the company.
What happened
Security researcher Anurag Sen of CyPeace found an Amazon-hosted storage server belonging to Duales, the Toronto company behind the Duc money-transfer app, that anyone could open in a browser without a password, TechCrunch reported on 2 April 2026. The server listed more than 360,000 files, stored unencrypted, with uploads dating from September 2020 through April 2026.
The files included driving licences, passports, verification selfies, customer names and home addresses, and transaction records showing dates, times and amounts. The app, which has more than 100,000 Android downloads, lets users send money to other users, including overseas.
Confirmed vs. claimed
Confirmed: The files were made inaccessible after TechCrunch alerted the company, though a directory listing of them remained visible. Canada's Office of the Privacy Commissioner said it had contacted Duales to obtain information and determine next steps.
Company position: chief executive Henry Martinez González said the data sat on a "staging site" used for testing and that "all protections are in place". He did not explain why real customer documents were publicly reachable, and would not say whether logs exist to show who else accessed them.
Who is affected
Duc app customers who uploaded ID documents or made transfers since September 2020. No country breakdown of affected customers has been published.
What to do
- If you used Duc, watch for a notice from Duales and for phishing that quotes your transfers.
- An exposed passport or licence plus a selfie can help criminals pass identity checks; watch for accounts or loans opened in your name.
- Follow our checklist on what to do after a data breach notice.
- Canadian residents can contact the Office of the Privacy Commissioner if the company does not respond.
Sources
More breaches in Canada
- Klue — 19 Jun 2026