> JapanHacked_
[Contained][Severity: Critical][Misconfiguration]

REQREA: a misconfiguration of the cloud storage behind its electronic check-in system "Tabiq" left identity-document images of 1,060,338 people accessible from outside

A misconfigured Amazon S3 bucket behind REQREA's check-in system "Tabiq" left identity-document images of 1,060,338 people open to outside access.

Disclosed

2026-06-30

Organizations involved

1

Leaked or at risk

1.1M

1,060,338

Downtime

Unknown

What happened

  1. It found that the cloud storage (Amazon S3) holding users' identity-document images was misconfigured and open to access by third parties. [1] [2]

  2. It announced the flaw in its handling of personal data. The scope was reported as identity-document images of 1,060,338 people. [1] [2]

Timeline

  1. Detected 2026-05-13
  2. Disclosed 2026-06-30
  3. 48 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[ID document image]

Organizations involved

  • [Breached][Critical]Fukuoka, Fukuoka, Hakata WardAccommodation, food and drink1,060,338 leaked

    REQREA Inc.

    A misconfigured cloud storage bucket (Amazon S3) holding identity-document images was open to access by third parties.

Open in organization search

Sources

  1. [1][Official]「Tabiq」における個人情報の取り扱いに関する お知らせとお詫びREQREA Inc. · 2026-06-30
  2. [2][News]Amazon S3 設定不備 ～ 電子チェックインシステム「Tabiq」で 1,060,338 人分の本人確認書類画像がアクセス可能にScanNetSecurity · 2026-07-14 08:05