Canadian Money Transfer App Duc Exposes Thousands of Passports and Driver's Licenses on Open Server

TechCrunch·medium signal

TechCrunch reports that Canadian money transfer app Duc left an Amazon-hosted server exposed without password protection, allowing unrestricted access to customer identity documents including driver's licenses and passports. The breach is a textbook example of basic cloud misconfiguration — no authentication on an S3 bucket containing PII — and highlights how fintech startups handling sensitive identity data continue to fail at foundational security hygiene.