Cannabis Club Software Leaks 1 Million IDs Online

A significant data breach exposed over 985,000 identity documents, including passports and driver's licenses, to public URLs. This occurred because the software used by cannabis clubs in Spain, provided by Irish company Cannabis Club Systems (CCS), formally Nefos Solutions, lacked adequate security. The exposed information potentially included users' phone numbers, addresses, and cannabis consumption details. Vulnerabilities were discovered within the PuffPal app and associated APIs, allowing easy access to user profiles by altering a single number in a URL. Nefos Solutions has since taken steps to address the issue, shutting down the affected PuffPal system and APIs until they can be properly secured. The company is collaborating with Ireland's Data Protection Authority (DPC) and claims there is no evidence of unauthorized access beyond the security researcher who discovered the flaw. Nefos stated they are parting ways with the firm responsible for developing the app and aim to release a new, independently verified secure application within months. The company acknowledged potential legal repercussions under EU law for delayed disclosure.