Prison Data Exposed: Driver's Licenses on Open Web

Prison calling service Pay Tel has experienced a significant data breach, with a publicly exposed cloud server revealing sensitive information about its users. The Microsoft Azure-hosted server, left unprotected, stored at least 300,000 scans of driver's licenses and other government-issued identification documents. Researchers from UpGuard discovered the lapse on May 7, 2026, and alerted the company, which subsequently secured the server.

In addition to identification documents, the exposed data includes inmate communications such as text messages, handwritten notes, and financial records. User-uploaded photos may have also revealed precise real-world locations, potentially including home addresses. This is Pay Tel's second known security lapse in two years, following a ransomware attack in June 2025. It remains unclear if Pay Tel will notify affected individuals or alert state attorneys general as required by law.