Home / Technology / Money App Leaks 360,000 Sensitive IDs
Money App Leaks 360,000 Sensitive IDs
2 Apr
Summary
- An unprotected server exposed over 360,000 files of personal data.
- The exposed data included driver's licenses and passports.
- The company resolved the exposure after being notified by researchers.
A significant data exposure occurred via an Amazon-hosted storage server belonging to the Duc App, a money-transfer service. The server was publicly accessible without a password, allowing anyone to view and download sensitive personal information belonging to potentially hundreds of thousands of individuals. This exposed data included government-issued documents like driver's licenses and passports, along with user selfies and transaction spreadsheets detailing names, addresses, and transfer information.
The security lapse was discovered earlier this week by security researcher Anurag Sen, who alerted TechCrunch. Sen noted that the server's web address was easy to guess, further simplifying unauthorized access. The exposed files, dating back to September 2020, were also stored unencrypted. Duales, the Toronto-based parent company, claimed the data was on a 'staging site' but did not explain the public accessibility.
Upon being contacted by TechCrunch, Duales confirmed the data exposure was resolved on Tuesday, making the files inaccessible, though the server's contents list remained visible. Canada's privacy regulator confirmed it is investigating and seeking more information from the company. This incident highlights a growing trend of apps and websites failing to adequately secure sensitive identity verification data they collect from users.
