Overview
- TechCrunch reported the exposure and verified that roughly 100,000 passport images and biometric selfies were accessible, and the storage was secured hours after the story published on Wednesday.
- The files were readable because an Amazon‑hosted storage bucket was misconfigured and a backend site bug allowed anyone with direct file URLs to view uploaded documents.
- Journalists confirmed the data by contacting affected people and found many photos contained precise location metadata, in some cases accurate enough to show home addresses.
- The site gave no clear security contact and did not respond directly to reporters; outreach produced responses from purported lawyers and a PR firm rather than verified management, and it is unclear whether users or regulators have been notified.
- The incident highlights risks of commercial intermediaries that mimic government services, points to common cloud‑storage failures, and could increase scrutiny of the UK’s digital ID plans and data‑breach notification practices.