Investigating

Reqrea Tabiq: ID-document images for 1,060,338 guests may have been publicly reachable via S3 misconfiguration

Possible data leak: Tabiq’s Amazon S3 bucket holding selfie/signature/passport images was publicly reachable. Press coverage began May 15, 2026; the company’s count-bearing formal notice is dated June 30. disclosedOn uses the formal official notice date; the earlier press piece is attached as a source.

Last updated: 2026-11-09

Overview

1,060,338 people (2020-01-20 to 2026-05-14). Reservations and cards out of scope.

Timeline

UnknownOccurred
2026-05-13Discovered
2026-06-30Disclosed

Organization response

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

What you can do

Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.

Sources

「Tabiq」における個人情報の取り扱いに関するお知らせとお詫び株式会社リクリエ · 2026-11-09
A hotel check-in system left a million passports and driver’s licenses open for anyone to seeTechCrunch · 2026-11-09
ご宿泊時のチェックインシステムにおける個人情報漏えいの恐れに関するお詫びとご報告株式会社リクリエ · 2026-11-09

Reqrea Tabiq: ID-document images for 1,060,338 guests may have been publicly reachable via S3 misconfiguration

Overview

Timeline

Organization response

What you can do

Sources

Related information

No published information yet

Comments and replies

Write a comment