A severe lapse in data security has come to light involving the Duc App, a money-transfer service owned by Toronto-based fintech company Duales, which publicly exposed potentially hundreds of thousands of its users’ highly sensitive personal data. The information, which included government-issued identification such as driver’s licenses and passports, along with selfies, full names, home addresses, and detailed financial transaction records, was accessible to anyone with a web browser, requiring no password or special authentication....