A security lapse at the prison calling service Pay Tel has left hundreds of thousands of driver’s licenses and other personal documents exposed online. According to UpGuard, a cybersecurity firm, a cloud server storing this information was found unprotected, with no password required for access.

The incident reveals yet another example of tech companies mishandling sensitive data. Pay Tel provides tablets in US prisons allowing inmates to make calls; customers must submit identification documents and profile photos to sign up, all now potentially viewable by anyone on the internet.

Inmates’ communications, including text messages and financial records, were also accessible due to this lapse. UpGuard alerted Pay Tel on May 7 but as of yet, no response from the company has been received. The data exposure follows a ransomware attack in June 2025, highlighting ongoing issues with cybersecurity.

It remains unclear whether Pay Tel plans to inform affected individuals or notify attorney generals under U.S. state data breach notification laws. Who, if anyone, is responsible for the firm's cyber security is also unknown.