It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I

It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes. Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.