Breach report
Japanese hotel check-in system Tabiq left over 1 million ID documents in an open bucket
AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.
Reqrea, the Japanese startup behind the Tabiq hotel check-in platform, left passports, driving licences and selfies in a public Amazon bucket. It has secured the bucket and says it is reviewing the exposure.
What happened
Security researcher Anurag Sen found an Amazon S3 storage bucket named "tabiq" that anyone could view in a web browser without a password, TechCrunch reported on 15 May 2026. It belonged to Tabiq, a digital hotel check-in system run by Japanese startup Reqrea. The bucket held more than 1 million passports, driving licences and face-verification selfies from guests, with files dated from early 2020 to May 2026. It had also been indexed by a public search engine for exposed cloud storage.
The bucket was locked after TechCrunch alerted Reqrea and Japan's JPCERT/CC coordination centre.
Confirmed vs. claimed
Confirmed by Reqrea: a director said the company is conducting a review with external legal counsel to determine the full scope of the exposure, is checking access logs, and plans to notify affected people once the investigation ends.
Unknown: how the bucket became public (Reqrea says it does not know), and whether anyone other than the researcher downloaded the files.
Who is affected
Guests who checked in at hotels using Tabiq between early 2020 and May 2026. TechCrunch and Security Affairs report the documents belong to hotel guests from around the world; no breakdown by country, and no list of the hotels involved, has been published.
What to do
- If you checked in at a Japanese hotel using a digital or self-service system since 2020, watch for a notice from the hotel or Reqrea.
- Treat unexpected emails or calls citing your passport number or hotel stay as possible phishing.
- Follow our checklist on what to do after a data breach notice.
- Hotels using identity-capture vendors should confirm how and where guest documents are stored.
Sources
More breaches in Japan
- Keio Corporation — 26 Sep 2026
- Times Car (Park24) — 25 Sep 2026