{"id":3108843,"date":"2026-04-02T09:29:35","date_gmt":"2026-04-02T16:29:35","guid":{"rendered":"https:\/\/techcrunch.com\/?p=3108843"},"modified":"2026-04-02T10:38:43","modified_gmt":"2026-04-02T17:38:43","slug":"canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server","status":"publish","type":"post","link":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","title":{"rendered":"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web"},"content":{"rendered":"\n<p id=\"speakable-summary\" class=\"wp-block-paragraph\">A publicly accessible Amazon-hosted storage server allowed anyone with a web browser to access potentially hundreds of thousands of people\u2019s personal data without needing a password. This included driver\u2019s licenses, passports, and other personal information collected by the Duc App, a money-transfer service owned by Toronto-based Duales.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Canadian fintech company said it resolved the data exposure on Tuesday after TechCrunch alerted its chief executive that one of the company\u2019s cloud storage servers was publicly listing its contents, without a password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The data was also stored unencrypted, meaning anyone with a link to the data was able to view it in full.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Anurag Sen, a security researcher at <a href=\"https:\/\/cypeace.net\/en\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CyPeace<\/a> who discovered the security lapse earlier in the week, contacted TechCrunch in an effort to notify the data&#8217;s owner. Sen said that anyone could view and download the data using their browser just by knowing the easy-to-guess web address of the storage server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to Sen, the Amazon-hosted storage server listed over 360,000 files containing government-issued documents and other information used by customers to verify their identity through &#8220;know your customer&#8221; checks. These files included user-uploaded selfies to prove their real-world likeness.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">TechCrunch could not ascertain the precise number of exposed driver&#8217;s licenses and passports; however, several folders in the exposed bucket each contained tens of thousands of user-uploaded files, a sampling of which listed driver&#8217;s licenses, passports, and selfies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Duales touts its app as a way for users to send money to other users, including overseas in Cuba and elsewhere. Its <a href=\"https:\/\/play.google.com\/store\/apps\/details?id=com.ducwallet\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Android app listing<\/a> on the Google Play app store shows more than 100,000 user downloads to date.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The files, which dated back to September 2020 and were being uploaded daily, also contained spreadsheets listing customer names, home addresses, and the dates, times, and details of their transactions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When reached by email, Duales chief executive Henry Martinez Gonz\u00e1lez told TechCrunch that the data was stored on a &#8220;staging site,&#8221; referring to a website used primarily for testing, but did not explain why customers&#8217; personal information was publicly accessible in the same database.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;All protections are in place,&#8221; Martinez Gonz\u00e1lez said. &#8220;We are notifying the appropriate\u00a0parties. We have not\u00a0contracted any services from you.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After TechCrunch emailed the company, the files on the storage server were made inaccessible, though a list of the server\u2019s contents is still visible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Martinez Gonz\u00e1lez would not say if the company had the technical means, such as logs, to determine who or how many people accessed the data.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Duc App&#8217;s website <a href=\"https:\/\/web.archive.org\/web\/20260402143724\/https:\/\/web.ducapp.com\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">appeared briefly down<\/a> on Thursday, and displayed a &#8220;bad gateway&#8221; error.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s not clear how or for what reason Duales left its Amazon-hosted storage server publicly open to the internet. In recent years, Amazon has added security checks to prevent users from inadvertently exposing their data to the internet after a series of <a href=\"https:\/\/techcrunch.com\/2019\/04\/03\/facebook-records-exposed-server\/\">high-profile<\/a> <a href=\"https:\/\/techcrunch.com\/2020\/04\/16\/clearview-source-code-lapse\/\">incidents<\/a> where <a href=\"https:\/\/techcrunch.com\/2019\/01\/24\/mortgage-loan-leak-gets-worse\/\" target=\"_blank\" rel=\"noreferrer noopener\">several<\/a> <a href=\"https:\/\/techcrunch.com\/2019\/05\/08\/samsung-source-code-leak\/\" target=\"_blank\" rel=\"noreferrer noopener\">corporate<\/a> <a href=\"https:\/\/techcrunch.com\/2020\/02\/23\/rallyhood-exposed-decade-data\/\" target=\"_blank\" rel=\"noreferrer noopener\">giants<\/a>, including <a href=\"https:\/\/www.zdnet.com\/article\/nsa-leak-inscom-exposes-red-disk-intelligence-system\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">a U.S. spy agency<\/a>, published sensitive data to the web due to misconfigurations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When reached by TechCrunch as part of our outreach to contact the app&#8217;s owner, Canada&#8217;s privacy regulator said it was seeking more information from the company.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;The Office of the Privacy Commissioner of Canada has reached out to the company to obtain more information and determine next steps,&#8221; a spokesperson for the regulator told TechCrunch by email, declining to comment further.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Duc App is the latest app in a list of recent security lapses involving the exposure of other people&#8217;s sensitive identity data. This data exposure comes as apps and websites are increasingly requiring their users to upload their government-issued documents to verify who they say they are but without taking enough steps to secure the data that they collect.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Last year, popular app TeaOnHer exposed <a href=\"https:\/\/techcrunch.com\/2025\/08\/13\/how-we-found-teaonher-spilling-users-drivers-licenses-in-less-than-10-minutes\/\" target=\"_blank\" rel=\"noreferrer noopener\">thousands of its users&#8217; passports and driver&#8217;s licenses<\/a>, which the app required users to upload before allowing them into the app&#8217;s gated community. Discord last year also confirmed a data breach affecting <a href=\"https:\/\/techcrunch.com\/2025\/10\/09\/discord-suffers-data-breach-impacting-at-least-70000-users\/\">around 70,000 government-issued documents<\/a> uploaded by users who sought to verify their age, amid a worldwide effort to <a href=\"https:\/\/techcrunch.com\/2026\/02\/24\/apple-rolls-out-age-verification-tools-worldwide-to-comply-with-growing-web-of-child-safety-laws\/\" target=\"_blank\" rel=\"noreferrer noopener\">enact online age checking laws<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password. <\/p>\n","protected":false},"author":133574210,"featured_media":2814826,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tc-featured-article":false,"tc-header-option":"","tc-breaking-news":false,"tc-article-brief":false,"carmot_uuid":"","apple_news_api_created_at":"2026-04-02T16:29:41Z","apple_news_api_id":"8096ed3f-525c-42c7-b772-d64cd2fa7c4e","apple_news_api_modified_at":"2026-04-02T17:38:42Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAw==","apple_news_api_share_url":"https:\/\/apple.news\/AgJbtP1JcQse3ctZM0vp8Tg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":[],"apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"tc_subtitle":"","tc_featured_image_disabled":false,"tc_exclude_from_rss_feed":false,"tc_exclude_from_content_rivers":false,"footnotes":""},"categories":[577030453,21587494],"tags":[449557106,22376,965824,102934,216504,577319684],"tc_region":[],"tc_event":[],"tc_storyline_tax":[],"coauthors":[576607994],"class_list":["post-3108843","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-fintech","category-security","tag-canada","tag-exclusive","tag-cybersecurity","tag-money-transfer","tag-fintech","tag-data-exposure"],"apple_news_notices":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v25.1 (Yoast SEO v25.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Money transfer app Duc exposed thousands of driver&#039;s licenses and passports to the open web | TechCrunch<\/title>\n<meta name=\"description\" content=\"An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Exclusive: Money transfer app Duc exposed thousands of driver&#039;s licenses and passports to the open web\" \/>\n<meta property=\"og:description\" content=\"An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\" \/>\n<meta property=\"og:site_name\" content=\"TechCrunch\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/techcrunch\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-02T16:29:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-02T17:38:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg?resize=1200,675\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Zack Whittaker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@TechCrunch\" \/>\n<meta name=\"twitter:site\" content=\"@TechCrunch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zack Whittaker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\"},\"author\":{\"name\":\"Zack Whittaker\",\"@id\":\"https:\/\/techcrunch.com\/#\/schema\/person\/f06276d38f71bd2a876003b492b0b4de\"},\"headline\":\"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web\",\"datePublished\":\"2026-04-02T16:29:35+00:00\",\"dateModified\":\"2026-04-02T17:38:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\"},\"wordCount\":701,\"publisher\":{\"@id\":\"https:\/\/techcrunch.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg\",\"keywords\":[\"Canada\",\"Exclusive\",\"cybersecurity\",\"money transfer\",\"Fintech\",\"data exposure\"],\"articleSection\":[\"Fintech\",\"Security\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/techcrunch.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\",\"url\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\",\"name\":\"Money transfer app Duc exposed thousands of driver's licenses and passports to the open web | TechCrunch\",\"isPartOf\":{\"@id\":\"https:\/\/techcrunch.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg\",\"datePublished\":\"2026-04-02T16:29:35+00:00\",\"dateModified\":\"2026-04-02T17:38:43+00:00\",\"description\":\"An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.\",\"breadcrumb\":{\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage\",\"url\":\"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg\",\"contentUrl\":\"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg\",\"width\":1920,\"height\":1080,\"caption\":\"money emerging from a firehose\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/techcrunch.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/techcrunch.com\/#website\",\"url\":\"https:\/\/techcrunch.com\/\",\"name\":\"TechCrunch\",\"description\":\"Startup and Technology News\",\"publisher\":{\"@id\":\"https:\/\/techcrunch.com\/#organization\"},\"alternateName\":\"TC\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/techcrunch.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/techcrunch.com\/#organization\",\"name\":\"TechCrunch\",\"alternateName\":\"TC\",\"url\":\"https:\/\/techcrunch.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/techcrunch.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/techcrunch.com\/wp-content\/uploads\/2018\/04\/tc-logo-2018-square-reverse2x.png?resize=1200,1200\",\"contentUrl\":\"https:\/\/techcrunch.com\/wp-content\/uploads\/2018\/04\/tc-logo-2018-square-reverse2x.png?resize=1200,1200\",\"width\":1200,\"height\":1200,\"caption\":\"TechCrunch\"},\"image\":{\"@id\":\"https:\/\/techcrunch.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/techcrunch\",\"https:\/\/x.com\/TechCrunch\",\"https:\/\/mstdn.social\/@TechCrunch\",\"https:\/\/bsky.app\/profile\/techcrunch.com\",\"https:\/\/www.threads.net\/@techcrunch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/techcrunch.com\/#\/schema\/person\/f06276d38f71bd2a876003b492b0b4de\",\"name\":\"Zack Whittaker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/techcrunch.com\/#\/schema\/person\/image\/46dbec761164bf931155cde6408cd079\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1099c2a5bc8d3b9d36c58466359702654ca1d0824999adb24660b78d8e685d76?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1099c2a5bc8d3b9d36c58466359702654ca1d0824999adb24660b78d8e685d76?s=96&d=identicon&r=g\",\"caption\":\"Zack Whittaker\"},\"description\":\"Zack Whittaker is the security editor at TechCrunch. You can send tips securely via Signal and WhatsApp to +1 646-755-8849. He can also be reached by email at zack.whittaker@techcrunch.com.\",\"sameAs\":[\"https:\/\/mastodon.social\/@zackwhittaker\"],\"url\":\"https:\/\/techcrunch.com\/author\/zack-whittaker\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Money transfer app Duc exposed thousands of driver's licenses and passports to the open web | TechCrunch","description":"An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","og_locale":"en_US","og_type":"article","og_title":"Exclusive: Money transfer app Duc exposed thousands of driver's licenses and passports to the open web","og_description":"An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.","og_url":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","og_site_name":"TechCrunch","article_publisher":"https:\/\/www.facebook.com\/techcrunch","article_published_time":"2026-04-02T16:29:35+00:00","article_modified_time":"2026-04-02T17:38:43+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg?resize=1200,675","type":"image\/jpeg"}],"author":"Zack Whittaker","twitter_card":"summary_large_image","twitter_creator":"@TechCrunch","twitter_site":"@TechCrunch","twitter_misc":{"Written by":"Zack Whittaker","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#article","isPartOf":{"@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/"},"author":{"name":"Zack Whittaker","@id":"https:\/\/techcrunch.com\/#\/schema\/person\/f06276d38f71bd2a876003b492b0b4de"},"headline":"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web","datePublished":"2026-04-02T16:29:35+00:00","dateModified":"2026-04-02T17:38:43+00:00","mainEntityOfPage":{"@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/"},"wordCount":701,"publisher":{"@id":"https:\/\/techcrunch.com\/#organization"},"image":{"@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage"},"thumbnailUrl":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg","keywords":["Canada","Exclusive","cybersecurity","money transfer","Fintech","data exposure"],"articleSection":["Fintech","Security"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/techcrunch.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","url":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","name":"Money transfer app Duc exposed thousands of driver's licenses and passports to the open web | TechCrunch","isPartOf":{"@id":"https:\/\/techcrunch.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage"},"image":{"@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage"},"thumbnailUrl":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg","datePublished":"2026-04-02T16:29:35+00:00","dateModified":"2026-04-02T17:38:43+00:00","description":"An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.","breadcrumb":{"@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#primaryimage","url":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg","contentUrl":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg","width":1920,"height":1080,"caption":"money emerging from a firehose"},{"@type":"BreadcrumbList","@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/techcrunch.com\/"},{"@type":"ListItem","position":2,"name":"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web"}]},{"@type":"WebSite","@id":"https:\/\/techcrunch.com\/#website","url":"https:\/\/techcrunch.com\/","name":"TechCrunch","description":"Startup and Technology News","publisher":{"@id":"https:\/\/techcrunch.com\/#organization"},"alternateName":"TC","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/techcrunch.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/techcrunch.com\/#organization","name":"TechCrunch","alternateName":"TC","url":"https:\/\/techcrunch.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/techcrunch.com\/#\/schema\/logo\/image\/","url":"https:\/\/techcrunch.com\/wp-content\/uploads\/2018\/04\/tc-logo-2018-square-reverse2x.png?resize=1200,1200","contentUrl":"https:\/\/techcrunch.com\/wp-content\/uploads\/2018\/04\/tc-logo-2018-square-reverse2x.png?resize=1200,1200","width":1200,"height":1200,"caption":"TechCrunch"},"image":{"@id":"https:\/\/techcrunch.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/techcrunch","https:\/\/x.com\/TechCrunch","https:\/\/mstdn.social\/@TechCrunch","https:\/\/bsky.app\/profile\/techcrunch.com","https:\/\/www.threads.net\/@techcrunch"]},{"@type":"Person","@id":"https:\/\/techcrunch.com\/#\/schema\/person\/f06276d38f71bd2a876003b492b0b4de","name":"Zack Whittaker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/techcrunch.com\/#\/schema\/person\/image\/46dbec761164bf931155cde6408cd079","url":"https:\/\/secure.gravatar.com\/avatar\/1099c2a5bc8d3b9d36c58466359702654ca1d0824999adb24660b78d8e685d76?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1099c2a5bc8d3b9d36c58466359702654ca1d0824999adb24660b78d8e685d76?s=96&d=identicon&r=g","caption":"Zack Whittaker"},"description":"Zack Whittaker is the security editor at TechCrunch. You can send tips securely via Signal and WhatsApp to +1 646-755-8849. He can also be reached by email at zack.whittaker@techcrunch.com.","sameAs":["https:\/\/mastodon.social\/@zackwhittaker"],"url":"https:\/\/techcrunch.com\/author\/zack-whittaker\/"}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web","url":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/","mainEntityOfPage":{"@type":"WebPage","@id":"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/"},"thumbnailUrl":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg?w=150","image":{"@type":"ImageObject","url":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg"},"articleSection":"Fintech","author":[{"@type":"Person","name":"Zack Whittaker"}],"creator":["Zack Whittaker"],"publisher":{"@type":"Organization","name":"TechCrunch","logo":"https:\/\/techcrunch.com\/wp-content\/uploads\/2015\/02\/cropped-cropped-favicon-gradient.png"},"keywords":["canada","exclusive","cybersecurity","money transfer","fintech","data exposure"],"dateCreated":"2026-04-02T16:29:35Z","datePublished":"2026-04-02T16:29:35Z","dateModified":"2026-04-02T17:38:43Z"},"rendered":"<meta name=\"parsely-title\" content=\"Money transfer app Duc exposed thousands of driver&#8217;s licenses and passports to the open web\" \/>\n<meta name=\"parsely-link\" content=\"https:\/\/techcrunch.com\/2026\/04\/02\/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server\/\" \/>\n<meta name=\"parsely-type\" content=\"post\" \/>\n<meta name=\"parsely-image-url\" content=\"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg?w=150\" \/>\n<meta name=\"parsely-pub-date\" content=\"2026-04-02T16:29:35Z\" \/>\n<meta name=\"parsely-section\" content=\"Fintech\" \/>\n<meta name=\"parsely-tags\" content=\"canada,exclusive,cybersecurity,money transfer,fintech,data exposure\" \/>\n<meta name=\"parsely-author\" content=\"Zack Whittaker\" \/>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/techcrunch.com\/p.js"},"jetpack_featured_media_url":"https:\/\/techcrunch.com\/wp-content\/uploads\/2024\/07\/money-firehose.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/posts\/3108843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/users\/133574210"}],"replies":[{"embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/comments?post=3108843"}],"version-history":[{"count":8,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/posts\/3108843\/revisions"}],"predecessor-version":[{"id":3108909,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/posts\/3108843\/revisions\/3108909"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/media\/2814826"}],"wp:attachment":[{"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/media?parent=3108843"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/categories?post=3108843"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/tags?post=3108843"},{"taxonomy":"tc_region","embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/tc_region?post=3108843"},{"taxonomy":"tc_event","embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/tc_event?post=3108843"},{"taxonomy":"tc_storyline_tax","embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/tc_storyline_tax?post=3108843"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/techcrunch.com\/wp-json\/wp\/v2\/coauthors?post=3108843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}