Money transfer app Duc exposed thousands of driver’s licenses and passports to the open web

A misconfigured Amazon-hosted storage bucket used by the Duc App (Duales) exposed over 360,000 unencrypted files — including driver’s licenses, passports, identity-verification selfies, and transaction spreadsheets — that were publicly downloadable without a password. Researcher Anurag Sen alerted TechCrunch, TechCrunch notified the company, and the files were later made inaccessible; Canada’s privacy regulator has contacted the company, which has not confirmed whether logs exist to determine access.