Nearly a Million Passports Exposed on Open Internet - No Password Needed

Typing a few letters into my browser, I found myself staring at a young German woman's passport. Then a Spanish man's driver's license. Then the front and back of another guy's ID with a goofy grin. They were all sitting at public URLs — no password, no access control, nothing. Nearly a million of them.

Unsecured Cache Exposes Passport Photos

The trove belongs to customers of Cannabis Club Systems, the backend platform behind services like Nefos and Puffpal. Sammy Azdoufal, the security researcher who flagged the exposure, told me the data includes passports and photo IDs from multiple countries. "We have to do something about it as fast as possible, because people will find this and resell it. It will do damage," Azdoufal said.

Anybody who knew the right URL pattern could scrape the entire set. No authentication, no rate limiting — just raw identity documents ready for the taking. The sort of exposure that identity thieves and fraudsters dream about.

The Gaping Hole in Data Protection

This isn't a sophisticated hack. No zero-days, no SQL injection. The documents were stored in a publicly accessible object store, probably misconfigured S3 buckets or similar. Cannabis Club Systems collects sensitive KYC material — passports, driver's licenses — to verify ages for cannabis delivery and club memberships. None of it was encrypted at rest behind an auth wall.

Azdoufal discovered the leak during routine scanning. The scale is staggering: nearly a million unique identity documents. For context, that's roughly the same as the entire population of a city like San Francisco having their passports posted online.

What Happens Next

Azdoufal reported the issue to the companies involved. Taking the data offline is step one. But the damage is already done — once a passport photo hits the open internet, it gets scraped, copied, and traded on dark web forums within hours. The real question is how many of these IDs will end up used for synthetic identity fraud or loan applications.

Cannabis Club Systems needs to explain why KYC data was stored on a public URL in the first place. For everyone else, this is a reminder: if your app collects government IDs, treat them like the crown jewels — because they are, and the crown is already gone.

Source: Nearly a million passports and photo IDs were left unprotected on the public internet
Domain: theverge.com