Top money transfer site Duc leaks user passport and driving license data info online

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

• Duc app exposed 360,000 unencrypted customer files
• Data included IDs, addresses, and transaction details
• Database secured after researcher alerted company

Duc App, a Canadian money transfer service provider, was leaking sensitive customer data to the wide web, allowing anyone with an internet connection and a browser to access it.

Security researcher Anurag Sen from CyPeace recently discovered a publicly accessible Amazon-hosted storage server with sensitive data on hundreds of thousands of people.

This included people’s names, home addresses, but also the dates, times, and details of their transactions. They also contained driver’s licenses, passports, and other documents collected during the Know Your Customer (KYC) registration process.

Article continues below