Money transfer app Duc exposed sensitive user data

The money transfer app Duc, owned by Toronto-based Duales, has exposed thousands of users' sensitive personal information, including driver's licenses and passports, to the public internet. The data was stored unencrypted on an Amazon-hosted server, accessible without a password. Security researcher Anurag Sen discovered the lapse, which included over 360,000 files containing identity documents and customer verification information. Duales claims the data was on a 'staging site' and has since secured the server, but it remains unclear how many individuals accessed the exposed information. Canada's privacy regulator is investigating the incident.