Duc App Exposed 360,000 Unencrypted Customer Files in Major Data Leak A Canadian money transfer service, Duc App, left a publicly accessible Amazon-hosted database containing sensitive customer data, exposing over 360,000 unencrypted files. Security researcher Anurag Sen of CyPeace discovered the breach, which included personal details such as names, home addresses, transaction records, and KYC documents like driver’s licenses and passports. The exposed files, dating back to September 2020 and updated daily, were accessible to anyone with an internet connection. After Sen alerted TechCrunch, the publication contacted Duc App’s parent company, Duales, which secured the database. Duales CEO Martinez González confirmed the data was stored on a "staging site" but did not explain why it was publicly accessible. While the company stated that "all protections are now in place," it remains unclear whether malicious actors accessed the data before its discovery. Cloud misconfigurations, often due to misunderstandings about security responsibilities, are a leading cause of such leaks. The incident highlights ongoing risks in improperly secured cloud storage.