Pay Tel Secured Exposed Server Holding 300,000 Driver Licenses

Security researchers at UpGuard identified an unprotected Microsoft Azure storage server belonging to prison calling service Pay Tel that contained at least 300,000 driver license scans and other government-issued identity documents. The server required no password and allowed anyone on the web to access the files.

UpGuard said the exposed material also included user profile photos, text messages, handwritten notes, and financial records connected to inmate communications.

Tel requires customers to submit identification documents and a profile photo before using its tablets and communication devices provided to prisons across much of the United States. Some of the uploaded photos contained location metadata precise enough to identify home addresses, according to UpGuard.

UpGuard alerted Pay Tel on May 7 and followed up days later. The company secured the server after the notifications. Pay Tel has not acknowledged the incident or stated whether it will notify affected individuals or state attorneys general under data breach notification laws.

This marks Pay Tel's second known security lapse in two years.

The company experienced a ransomware attack in June 2025. Pay Tel president Vincent Townsend did not respond to questions about the latest exposure.