Money transfer app Duc exposed thousands of driver’s licenses and passports to the open web

A significant security breach has been uncovered involving the Duc App, a money-transfer platform owned by the Canadian fintech company Duales. A misconfigured Amazon-hosted storage server was found to be publicly accessible, putting the personal data of potentially hundreds of thousands of users at risk. This unprotected data included driver’s licenses, passports, and other sensitive information collected by the app. The issue was brought to light after Anurag Sen, a security researcher at CyPeace, discovered the vulnerability and notified TechCrunch. He highlighted that anyone with access to the straightforward URL of the storage server could easily view and download the exposed files without any password protection. The storage server reportedly contained over 360,000 files, which included essential documents needed for “know your customer” identity verification processes. In addition to government-issued identification, the files also comprised user-uploaded selfies meant to confirm users' identities. The Duc App, which is designed to facilitate money transfers, particularly to regions like Cuba, has amassed more than 100,000 downloads on the Google Play Store. However, this breach raises serious concerns about the security measures in place to protect users' personal information. The files exposed not only included identification documents but also spreadsheets containing customer names, home addresses, and transaction details dating back to September 2020. Duales’ CEO, Henry Martinez González, responded to inquiries about the breach, stating that the data had been stored on a “staging site” used for testing purposes. However, he did not clarify why such sensitive information was left publicly accessible. After being contacted by TechCrunch, access to the files was promptly restricted, although a list of the contents remained visible. The breach has drawn attention from Canada’s privacy regulatory body, which has initiated communication with Duales to gather further information and assess next steps. This incident is part of a troubling trend, as more apps and websites require users to upload sensitive personal documents for verification, often without implementing adequate security measures. The Duc App is not alone in facing scrutiny; other platforms have recently experienced similar lapses, including the TeaOnHer app and Discord, both of which have had their users’ sensitive identity data compromised. As such incidents continue to occur, the importance of robust data protection practices cannot be overstated.