NEARLY 1M PASSPORTS, IDS EXPOSED ON PUBLIC INTERNET

A security researcher discovered the trove of sensitive identity documents by simply typing a few letters and numbers into a web browser. The findings reveal a significant data exposure affecting citizens across multiple nations. The documents included front and back images of driver's licenses and complete passport scans—the type of materials that form the foundation of identity theft. Each image was individually accessible via direct URL, meaning anyone who obtained a link could view the document without authentication. The exposed files were stored on public-facing servers with no password requirements or IP restrictions. This represents a fundamental security failure, as identity documents should never be accessible without multiple layers of protection. Such breaches typically occur when organizations fail to implement basic security controls while storing sensitive documents. Common causes include misconfigured cloud storage, inadequate access controls, and a failure to encrypt sensitive data. The scale of this exposure—nearly one million documents—suggests the vulnerability affected multiple organizations or a single service used by many entities. The documents' diversity indicates victims span multiple countries and potentially multiple industries. Identity document exposure carries serious consequences for affected individuals. Exposed passports and IDs can be used to open fraudulent accounts, apply for credit, or enable identity theft. Foreign nationals face additional risks, including potential issues with immigration authorities or travel complications. No details have been released regarding which organizations were responsible for storing the documents, how long they remained exposed, or whether the vulnerability has been patched. The discovery underscores the ongoing challenge of securing sensitive personal data in digital systems, particularly when organizations handle millions of identity documents. Securityresearchers recommend individuals monitor their credit reports and consider identity theft protection if their documents were among those exposed.