One Million Passport Records Reported Leaked Online From Cannabis-Club App

Identity-data exposures continue at scale. A cannabis-club membership platform reportedly left nearly a million passports and ID photos reachable on the open internet with no password — a consumer-notification story for the week.

DUBLIN — Security publications on or around June 28, 2026 reported that a software platform used to manage membership of cannabis social clubs left more than a million member records — including roughly 985,000 photographs of identity documents and some 923,000 passport or national-ID numbers — reachable on the open internet with no password, according to a researcher's disclosure that was amplified by Bruce Schneier's widely read security blog. The originating service was identified as CCS Nube, a backend tied to the PuffPal membership app and operated by the company Nefos. The exposure was characterized as a misconfiguration rather than a sophisticated intrusion: the records, reporting indicates, sat at predictable web addresses that returned full profiles to anyone who sent a basic request.

The account is, at the brief stage, a consumer-notification and regulatory-follow-up story rather than a confirmed breach with attribution. The figures originate from a single researcher's technical write-up, corroborated by mainstream technology reporting, and the most consequential downstream questions — who gets notified, by whom, and on what timeline — remain in motion. It lands alongside a run of recent identity-document exposures The CyberSignal has tracked, from a UK visa portal that spilled applicants' passports and selfies to a prison phone-service vendor that exposed 300,000 drivers' licenses.

What the Publication Documented

The thread was picked up by Schneier on Security, which framed the episode in a single observation: "a high-value credential — a passport — was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it's the low-value system that got hacked, putting the high-value credential at risk." Schneier's post pointed onward to the underlying technical disclosure, a researcher write-up published to GitHub by Sammy Azdoufal, a French security researcher who said he discovered the exposed records after joining a cannabis social club in Barcelona and decompiling the club's app.

According to that disclosure, the backend platform — identified as CCS Nube and tied to the PuffPal membership app operated by the company Nefos — assigned members sequential identification numbers and returned full member profiles to anyone who sent a basic web request. As The Verge reported, the researcher counted 1,082,680 member records, roughly 923,543 passport or national-ID numbers, and 985,841 identity-document photographs, all stored at predictable, unauthenticated web addresses. Profiles were said to also include home addresses, phone numbers, dates of birth and consumption-related details.

Several characterizations in the account remain at the level of a single researcher's analysis corroborated by mainstream reporting, rather than an official, fully audited disclosure. The CyberSignal is therefore describing the counts and mechanics as reported. What is not in dispute is the shape of the failure as documented: identity documents collected for an age- and membership-verification purpose were, according to the disclosure, reachable without any access control — the kind of exposure that turns a record count into a notification obligation.

Consumer-Notification Awareness

For the people whose documents were reportedly exposed, the practical question is notification — and that is where the account becomes a consumer-facing story rather than a purely technical one. Nefos has acknowledged, in comments reported by mainstream technology press, that it is in contact with Ireland's Data Protection Commission and that it intends to communicate with everyone potentially affected. The company has also conceded that it did not disclose the exposure within the 72-hour window the EU's General Data Protection Regulation requires, a gap that itself shapes how and when affected members learn what happened.

Individuals who used a cannabis-club membership app that relied on uploading a passport or national ID should treat this as a prompt to stay alert for direct notification from the operator and to monitor for misuse of the specific document they submitted. Where a passport image and number are exposed together, the durable risk is identity impersonation and document fraud rather than a quick password reset; the mitigations — vigilance against fraudulent applications opened in one's name, and, where a jurisdiction allows, requesting a replacement document — are slower and more deliberate than the steps that follow a leaked password.

The broader awareness point is that identity-document exposures rarely arrive with a clean, centralized notification. When the holder of the data is a small operator rather than a major institution, affected people may first hear about an exposure through press coverage — as here — rather than through a letter. That dynamic is precisely why a consumer-notification framing matters: it shifts attention from the headline number to the concrete obligation to inform a million individuals, across multiple countries, that a document tied to their identity was reportedly left in the open.

Sector-Advisory Implications for Identity-Data Exposures

The structural lesson here is one that runs through a growing list of identity-data incidents: collecting a high-assurance credential for a low-stakes purpose concentrates risk in whoever ends up storing it. A cannabis social club needs to confirm that a prospective member is an adult; a passport scan is an exceptionally heavyweight way to answer that question, and once collected it becomes a liability that must be defended to a far higher standard than the underlying transaction warrants.

This pattern is not unique to one sector. The CyberSignal has documented a steady cadence of exposures in which identity documents collected for verification became the loss — a UK visa portal that left applicants' passports and selfies reachable, a prison phone-service vendor that exposed roughly 300,000 drivers' licenses, and a hospital system that exposed 1.8 million biometric fingerprint records. The common thread is that the most sensitive data is often held not by the organization a consumer thinks they are dealing with, but by a third-party platform or vendor several steps removed.

For organizations that build or buy identity-verification systems, the advisory reading is conventional but worth restating against this case: minimize what is retained after a check completes, place access controls in front of any store of identity documents, avoid predictable or sequential identifiers that let an enumerator walk a dataset, and treat document images as among the highest-sensitivity assets in the estate. The reported failure mode here — sequential IDs returning full profiles at unauthenticated URLs — is exactly the kind of design choice a security review is meant to catch before a million records accumulate behind it.

Open Questions

Several specifics remain unconfirmed at the reporting stage, and the brief is deliberately conservative about them. The headline counts originate from a single researcher's write-up; while corroborated by mainstream reporting and amplified by a respected security commentator, they have not been independently audited in an official disclosure. The precise breakdown of affected nationalities, the exact number of distinct individuals as opposed to records, and whether full machine-readable-zone (MRZ) passport fields were present alongside the document images are not established in the material reviewed and are marked as not confirmed.

Also open is the regulatory trajectory. Nefos's acknowledgment that it missed the GDPR 72-hour notification window, and its stated contact with Ireland's Data Protection Commission, point toward a formal regulatory process, but any finding, penalty or required remediation lies ahead. The mechanics of notifying potentially affected members across multiple jurisdictions — who is contacted, in what order, and with what guidance — are likewise unresolved.

What is firmly established is enough to treat the episode as a consumer-notification story now: a membership platform that collected passports and national IDs for verification reportedly left those documents reachable on the open internet, the operator has conceded a notification failure, and a data-protection regulator is engaged. For readers, the durable takeaway is the one the case illustrates so plainly — every place a passport is uploaded becomes a place it can leak, and the safest exposure is the data a service never collected or kept in the first place.

The CyberSignal Analysis

The reported facts above are as documented by the researcher and mainstream press; what follows is The CyberSignal's editorial reading of what defenders and product teams should take from them. None of the judgments below are new reported facts, and the counts remain as reported.

Signal 01 — Niche Apps Collecting Government ID Are an Outsized Liability

The most useful way to read this episode is not as a cannabis-industry story but as a category warning about small consumer apps that reach for a passport to answer a low-stakes question. A social club needs to confirm that a prospective member is an adult; a passport scan is a wildly heavyweight instrument for that check, and the moment it is retained it converts a modest verification workflow into custody of a high-assurance identity credential. Our reading is that the liability an app takes on scales with the sensitivity of what it collects, not with the size of the business collecting it — a two-person operation that stores passports carries the same class of risk as a bank, without the same class of controls.

That mismatch is the design defect at the root of the reported exposure. A niche operator rarely has the security program, the review cadence, or the incident-response muscle that a store of nearly a million identity documents demands, yet nothing stops it from accumulating exactly that store. The defensive posture we would advocate is to treat any request for a passport in a consumer flow as a decision that must be justified against far cheaper alternatives — an age-estimation check or a one-time verification that retains nothing — because the cheapest way to avoid an identity-document breach is to never become the holder of the documents.

Signal 02 — Passport Data's Permanence and Cross-Border Reach Change the Stakes

What makes this class of exposure different from a leaked-password incident is that the exposed asset cannot be rotated. A passport number and image, once out, describe a durable, government-issued identity that a person carries for years, and the reported records here reportedly span members across multiple countries. That combination — permanence plus cross-border spread — means the downstream risk is identity impersonation and document fraud that can surface long after the incident fades from the news, in jurisdictions far from where the data was collected.

Our assessment is that this permanence should reframe how operators weigh the retention question. There is no equivalent of a forced password reset for a leaked passport; the remediation available to an affected person — vigilance against fraudulent applications, or requesting a replacement document where a jurisdiction allows it — is slow, manual, and incomplete. For product teams, the practical implication is that document images deserve the shortest possible retention life and the strongest access controls in the estate, precisely because the cost of getting it wrong lands on the individual and lasts.

Signal 03 — GDPR-Notification Exposure Is the Story's Center of Gravity

The detail we would put at the center of any post-incident review is not the record count but the operator's own concession that it missed the EU's 72-hour notification window. That admission moves the episode from a technical misconfiguration into a regulatory-exposure story, because under GDPR the failure to notify promptly is itself a distinct compliance gap that regulators can act on independently of the underlying exposure. With Ireland's Data Protection Commission engaged, the notification timeline becomes a matter of record rather than a footnote.

For any organization holding EU residents' personal data, the actionable interpretation is that breach-notification readiness is a control in its own right, not an afterthought triggered once an incident is understood. The operators who fare best under a regulator's review are the ones who can demonstrate a rehearsed process for detecting, assessing, and reporting an exposure inside the mandated window — and this case is likely to be graded as much on the notification failure as on the misconfiguration that caused it.

Sources