{"id":1879,"date":"2026-06-10T21:58:57","date_gmt":"2026-06-10T21:58:57","guid":{"rendered":"https:\/\/silvybrand.com\/?p=1879"},"modified":"2026-06-10T21:58:57","modified_gmt":"2026-06-10T21:58:57","slug":"passports-data-breach-cannabis-club-systems-nefos-puffpal","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=1879","title":{"rendered":"Nearly a million passports and photo IDs were left unprotected on the public internet"},"content":{"rendered":"


\n<\/p>\n

\n
\n

Typing a few letters and numbers into my web browser, I find myself gaping at the identity documents of complete strangers. The passport of a young woman from Germany. The passport of a man from Spain with glasses resting on his head. The front and back of another man\u2019s driver\u2019s license, a stereotypically goofy expression on his face.<\/p>\n<\/div>\n

\n

They were all sitting unprotected at public URLs, with no password or access control of any sort. If I sent you a link, you could have looked at someone\u2019s passport.<\/p>\n<\/div>\n

\n

\u201cWe have to do something about it as fast as possible, because people will find this and resell it. It will do damage,\u201d Sammy Azdoufal told me in May.<\/p>\n<\/div>\n

\n

Azdoufal is the security researcher who used Claude Code to help discover that every DJI Romo robot vacuum cleaner<\/a> and a million baby monitors and security cameras<\/a> were embarrassingly easy to hack. This time, he says he discovered over 985,000 photo IDs sitting on the public internet for any half-decent hacker to steal.<\/p>\n<\/div>\n

\n

If you\u2019ve visited a cannabis club in Spain, Azdoufal says, chances are your photo ID was among them \u2014 and possibly your phone number, address, your favorite strains of cannabis, and how much you consumed each month while there. Azdoufal says celebrities are in the database, too, and visitors from all over the world, including 30,000 from the United States. \u201cThey have famous people,\u201d says Azdoufal. \u201cPeople who don\u2019t want everyone to know they smoke weed.\u201d<\/p>\n<\/div>\n

\n

Here\u2019s a rough summary of the userbase that Azdoufal\u2019s automated tool was able to see, and the names of some of the clubs:<\/p>\n<\/div>\n

\n
\n
\n
\n
\n
\"\"<\/a><\/div>\n<\/div>\n<\/div>\n

Image: Sammy Azdoufal<\/cite><\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

It\u2019s not the clubs that didn\u2019t protect these identity documents. An Irish company called Cannabis Club Systems (CCS), formally Nefos Solutions, develops and provides the software these clubs use for sales, accounting, and admissions, including a verification system where receptionists upload your IDs and selfies to Nefos\u2019 cloud.<\/p>\n<\/div>\n

\n

Traditionally, you\u2019d need to provide a photo ID every time you wanted to get into a club. But with the verification system, the receptionist can pull up your stored identity documents and check if your face matches. There\u2019s also an optional app called PuffPal that lets clubs scan a QR code for faster entry.<\/p>\n<\/div>\n

\n

But when Azdoufal decompiled that PuffPal app, he explains in his report<\/a>, he discovered that Nefos had no meaningful level of security. He discovered a secret key for the Stripe payments platform sitting inside the app in plain text. He discovered he could pull up any member\u2019s profile just by changing one number. If those profiles included their phone number, home address, passport, and weed preferences, he now had access to them too.<\/p>\n<\/div>\n

\n

And then, he discovered that those passports, drivers licenses, and photo IDs were stored at public URLs as simple as this: https:\/\/ccsnubev2.com\/v8\/images\/_{club}\/ID\/{user_id}-front.jpg<\/p>\n<\/div>\n

\n

Those clubs were uploading 5,000 new photo IDs with these insecure URLs every day, Azdoufal tells me.<\/p>\n<\/div>\n

\n

He also found an admin portal accessible via the public internet \u2014 and that the cannabis clubs had a trivial level of security on their own accounts, using passwords that could theoretically be cracked in minutes with a modern GPU. Private chat messages between clubs and members through the PuffPal app were also vulnerable.<\/p>\n<\/div>\n

\n

The good news: roughly a month after we reached out to Nefos, the company seems to finally be taking meaningful action. The company says it\u2019s shutting down its entire PuffPal system and vulnerable APIs until they can be fixed \u2014 in Azdoufal\u2019s latest tests on June 10th, passport images and personal data seem to be secure. Nefos has also informed local authorities, and says it will take responsibility to make fixes, pay fines, and tell users what happened.<\/p>\n<\/div>\n

\n

In a phone interview, Nefos co-founder Andreas Nilsen tells The Verge<\/em> that he\u2019s in touch with Ireland\u2019s Data Protection Authority (DPC) about the data breach \u2014 a fact that DPC spokesperson Evan O\u2019Leary confirmed to us by email. \u201cWe have to communicate to everyone that was potentially exposed,\u201d Nilsen tells me, saying he hopes the DPC can show his company how to do that properly. Nilsen claims there\u2019s currently no evidence that any outsider accessed the data other than Azdoufal.<\/p>\n<\/div>\n

\n

But it took far too long for Nefos to take the threat seriously. It took five days and the threat of a story before the company replied to us, long after Azdoufal reached out. Then, Nefos began by papering over the holes instead of risking business.<\/p>\n<\/div>\n

\n

I was prepared to write this story at the beginning of June, after Azdoufal told me Nefos had finally locked down the passport images. But on June 4th, I surprised Azdoufal by showing him that his very own passport was online once again, without any protection.<\/p>\n<\/div>\n

\n

That\u2019s because Nefos had not yet stopped cannabis clubs from using the PuffPal app, and clubs were complaining the locked-down images weren\u2019t showing up the way they used to \u2014 so Nefos simply unlocked the images again. While Nilsen claims the images were locked down \u201c70 percent of the time\u201d since Azdoufal and I got in touch, it\u2019s pretty clear that Nefos made a decision to prioritize its customers instead of the threat.<\/p>\n<\/div>\n

\n

On June 9th, Azdoufal discovered that even though Nefos had locked down the passport images and photo IDs with tokens, everything else<\/em> in the user profiles was still easily accessible: passport numbers, phone numbers, email addresses, home addresses, everything.<\/p>\n<\/div>\n

\n

All a hacker had to do was type \u201ccurl -X POST https:\/\/ccsnubev2.com\/v8\/api\/userProfile.php -d \u201cuser_id=[NUMBER]&[CLUB NAME]=test&language=en\u201d into a command line, and the servers would freely give up a ream of personal information. After we brought this to Nefos\u2019 attention, that hole, too, has been closed.<\/p>\n<\/div>\n

\n

But how could the company be so careless? \u201cI don\u2019t want to put the blame on others because at the end of the day it resides with us,\u201d Nilsen says. But he does point the finger at 9Series<\/a>, an outsourcing firm he claims was responsible for developing the PuffPal app and creating all the vulnerable APIs it used to pull unprotected data from Nefos\u2019 user database. (9Series did not have a response by publish time.)<\/p>\n<\/div>\n

\n

Now that PuffPal is down, Nefos is emailing every club to let them know their members won\u2019t be able to use those QR codes for entry \u2014 but they can still pull up IDs from Nefos\u2019 servers after scanning a member\u2019s RFID card or typing in their phone number, among other examples.<\/p>\n<\/div>\n

\n

Nilsen claims his company will not simply re-launch unsecured PuffPal if the clubs ask. \u201cWe\u2019re going to tell them we can\u2019t,\u201d he says. \u201cWe will make sure, after this debacle, that this is verified by an independent security researcher and guarantee that this is 100 percent secure.\u201d He says Nefos is parting ways with 9Series, and hopes to have a new app within a few months.<\/p>\n<\/div>\n

\n

Nilsen says he\u2019s aware that under EU law<\/a>, his company legally had to disclose the breach within 72 hours or pay significant fines, something the company didn\u2019t do.<\/em> \u201cI\u2019m sure we\u2019ll get whatever kind of penalty there is,\u201d Nilsen says.<\/p>\n<\/div>\n

\n

Just last month, a website called the UK Visa Portal similarly exposed at least 100,000 passports<\/a> to anyone who could guess a URL. Let\u2019s hope this is a wakeup call.<\/p>\n<\/div>\n

Follow topics and authors<\/strong> from this story to see more like this in your personalized homepage feed and to receive email updates.<\/span><\/p>\n