9 ms·

One million passports leaked online

• adithyaharish 4mo ago
  I am sure even my passport would be part of the breach, are the passport holders beign notified of the breach?
• dgellow 4mo ago
  Oh god that’s pretty bad > The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. The infrastructure storing these identity documents—full passport scans, driver’s licenses with photos, names, and identifying numbers—was left completely unprotected on publicly accessible web servers. I cannot imagine the level of fines under GDPR for leaking that much PII
  • real_chudson 4mo ago
    The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines
    • dgellow 4mo ago
      Yep… not sure about more fines, but for sure more leaks
    • Kuinox 4mo ago
      How so, are you purely speculating or you found a hole in the zero knowledge proof system some countries are implementing ?
      • 2748484848 4mo ago
        [dead]
      • raron 4mo ago
        It is not using ZKP. Zero knowledge proof is mentioned as an optional experimental feature in the next release. https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/#7-experimental-features https://ageverification.dev/av-doc-technical-specification/d...
        • Kuinox 4mo ago
          The specs are for the pilot phase. The faq and other documents state that it will be using ZPK. There is already multiple tech proof of concept, ie: https://github.com/eu-digital-identity-wallet/av-lib-android-zkp-age-icao https://github.com/eu-digital-identity-wallet/av-lib-android...
    • forestry 4mo ago
      Is it requirement to retain the documents? Many are waiting for gatekeeper tech companies to organise around attestation rather than submission to third parties. I hope they are making progress.
    • TacticalCoder 4mo ago
      I had to receive a letter from France (I'm not french, I don't live in France, but we've got family real estate there). To be able to open this letter, online (!), I had to scan my EU ID card, tilt it, and scan my face (pointing at the camera, looking to the left, etc.). We're talking about a major french institution here, either public or private but colluding with the government to have their monopoly (don't know, don't care: they're all the same worms to me). Speaking of which... There's been a recent case in France where a very nice lady working for some public institution (basically the IRS) was giving the name/wealth of "targets" to her brother so that her brother and his friends could go and kidnap/torture (fingers of victims have been cut) family members of rich french persons. It's sickening and the real culprits are those creating the laws mandating this full on surveillance apparatus.
      • axus 4mo ago
        The governments want to retain their abilities to target people for kidnapping/finger-lopping.
    • ExoticPearTree 4mo ago
      > The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines So its a feature, not a bug and a clever revenue stream for the governments?
  • voakbasda 4mo ago
    Show me the consequences. I hear there are supposed to be repercussions, but these asshats never seem to pay for their crimes.
  • hahahaa 4mo ago
    Why can't verification simply be go to post office, clerk will affadavit that you presented correct ID via online form. Which could also do the photo lookup for good measure. Store that fact in the computer. Good for one ID usage. Good for less critical stuff like this weed thing (versus say a visa application which may need to store). The analogy is a nightclub bouncer checks your ID.
    • simoncion 4mo ago
      > The analogy is a nightclub bouncer checks your ID. ...the obvious thing to deploy is a cannabis club bouncer that checks your ID with only his eyes and hands and either bounces you or lets you in, depending on the outcome of that check. That's far simpler than involving some unrelated third party and far more secure than storing any information about the event in any computer.
• raverbashing 4mo ago
  That's good, just grab one of those whenever your need to prove your age online /s
  • Cider9986 4mo ago
    For liveness i suppose you need a good graphics card. So dystopian
    • sebastiennight 4mo ago
      > a good graphics card Well, see, for safety reasons we're not going to let consumers have those anymore. You could be doing all kinds of shenanigans, running LLMs locally like a pirate.
  • jubilee33 4mo ago
    Not even needed many times, I was recently at an overseas airport that wanted you to scan your passport to log into the internet. Ya not happening. On another device I downloaded a "sample" passport image of a British passport, the first one on Google images, pointed the phone at the device screen. "This will never work" , he thought as he was immediately logged in. All this stuff really hurts the people who follow the rules the most.
• gertrunde 4mo ago
  The lack of security is one thing, but why have they retained the information at all! iirc, one of the elements of GDPR is "storage limitation", i.e. you must not keep personal data for longer than you need it - and in this case, the data is only needed to verify the age of the user, and shouldn't ever be required again (unless people can now get younger). Once a document has been used to verify a person's identity and that the person is of legal age, there is no reason to retain a copy of the document any more. It would be reasonable and fair to retain a photo of the user to verify that the person matches the account, but that's it.
  • rationalist 4mo ago
    10 years after I took the ACT, I received a letter from a university that I never went to, saying my SSN was leaked. WHY THE F**k ARE THEY HOLDING ON TO THAT 10 YEARS LATER!?!?!? Of course now I know better than to give out my SSN to anyone who asks for it, but I didn't know that as a teenager. Until stupid s**t like this becomes illegal, it will just keep continuing.
    • vrsgjye 4mo ago
      [dead]
    • robrtsql 4mo ago
      Don't be so hard on 17-ish-year-old you. What exactly were you supposed to do? Not take the ACT (and probably not get into your desired college)?
      • DANmode 4mo ago
        Ask if it’s required, instead of assuming it is, is the point. Modern equivalent “move over here for your picture ‘for the doctor’.” No thanks, I’d like to opt-out!
      • AgentOrange1234 4mo ago
        This is a real problem. I was appalled when renewing my car this year that I now need a Texas by Texas account (https://www.texas.gov/texas-by-texas/ https://www.texas.gov/texas-by-texas/), which wants... a social security number because why?!?! Anyway, yet another data breach incoming.
• joe_mamba 4mo ago
  Damn, we even got passport leaks before GTA 6.
• emayljames 4mo ago
  This is the best one. Not a shady company website, or a paywalled site: https://boingboing.net/2026/06/28/a-million-passports-leaked-online-by-marijuana-club-portal.html https://boingboing.net/2026/06/28/a-million-passports-leaked...
• tartoran 4mo ago
  > Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk. Why do these systems hold onto user's data post verification?
  • observationist 4mo ago
    Why wouldn't they? There are probbaly significant downsides if they fail an audit requirement, and they're probably mandated to retain records for some period, with no consequences to extended retention. Set up a system so that it costs you nothing to do a bad thing but possibly wrecks you legally and financially to do the good thing, and people will inevitably do the bad thing. They shouldn't be collecting this information in the first place. The people who design these policies are incapable of actually building things that work. They are not the intelligent, competent leaders exercising a careful craft that they like to pretend they are. They keep going after age verification, online ID, central bank digital currencies, etc - keep this incident in mind. The people who implement and write these policies are morons. They don't game things out and plan for redundancy or resiliency. They don't take into account bad faith actors. They don't account for deliberate exploitation of the system.
    • onetokeoverthe 4mo ago
      [dead]
    • charles_f 4mo ago
      > Why wouldn't they? They most likely weren't allowed to keep it past the verification per GDPR art.5. Once the passport has been verified for whatever purpose they needed it ("age verified to be > 18yo on 2026-06-12" or "identity verified to be XXXX YYYY"), there is no legitimate use for the passport photo and details anymore, and they should delete it.
      • petercooper 4mo ago
        (I'm naive in this area, but..) I wonder if the various "proof of age" laws coming into play will clash with the GDPR in insidious ways. Like requiring identity providers to hold definitive "proof" of why they made an assessment rather than merely proving and discarding. I assume/hope there is some cryptographic way to do this rather than hang on to passport and ID images, however.
• vfclists 4mo ago
  Do the laws that mandate identity verification set security standards that the websites which collect and verify the data must meet?
• shmoobadge 4mo ago
  Much as passports are very important for proving identity etc, people who travel have had their passport scanned, photographed or photocopied by pretty much every hotel they've stayed in. I'm not sure the shoebox in the backroom in Koh Samui with the photocopies in constitutes good storage hygiene protocols. How that doesn't turn into rampant identity theft I don't know, or maybe it does? Not, happily, for me... yet.
  • Avshalom 4mo ago
    the whole "not being an automatable remote sql injection away from everything" quality of physical objects grants a filing cabinet a tremendous amount of inherent security compared to anything digital.
    • Terr_ 4mo ago
      Much like that old quip about the bandwidth of a vehicle full of tapes: "Never underestimate the at-rest security of a room full of filing cabinets." Friction and delay have always been aspects of security.
      • annzabelle 4mo ago
        Not sure if they're still doing this, but as of a few years ago, the IRS was still using literal trucks full of tapes to transport data to backup facilities. Tapes are good for this because they don't degrade as quickly as hard drives, so if you're actually looking to do archival storage that will outlast the cloud provider of the decade, they are surprisingly practical.
        • DANmode 4mo ago
          Does tape still burn really easily? Or has that been fixed?
          • Terr_ 4mo ago
            Compared to what what option, clay tablets of cuneiform? :p In terms of significant danger, perhaps you're thinking of nitrocellulose movie film that was phased out in the '50s.
• charles_f 4mo ago
  > Zero password protection on document storage systems > > No encryption for sensitive identity verification data > > Public URL access with no authentication requirements > > No access logging or monitoring systems in place Pretty much the bingo of secure storage, even CTF demos make it less obvious. Storing a document that they have no business keeping in the first place, with no security whatsoever.
• maipen 4mo ago
  So much of our information is being leaked nowadays that news like these don’t surprise me anymore… I think everyone should understand that if they truly want something private, storing it offline or destroying it completely, are the only safer options. Any sort of convenience to access said data, is a possible surface of attack.
• croes 4mo ago
  > No hacking was required—documents were accessible through direct URLs with zero authentication or encryption. You would be surprised what some courts already count as hacking
• spullara 4mo ago
  Remember that there is no such thing as identity theft. There is just fraud. You weren't involved at all.
  • lifestyleguru 4mo ago
    Identity theft is a term made up by banks and institutions who don't want to take responsibility for who they sign contracts with. Despite billions of profits they have every year.
    • petilon 4mo ago
      Exactly. We should stop saying "Identity Theft" because that lets financial institutions off the hook. "Identity Theft" sounds like it is either your fault for being careless with your identity, or the thief's fault for stealing it. How about "Negligent Verification Fraud"? That makes it clear it is the fault of the bank. It is impersonation enabled by the bank's lax verification process.
• Daz912 4mo ago
  [dead]
• cebert 4mo ago
  > PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. At least we’re keeping the children safe though by verifying ages. It’s worth giving up privacy for that…
  • hahahaa 4mo ago
    Yep. Teenagers are famously incapable of finding a dealer who might even be their mate.
• throwaway692675 4mo ago
  I'm aware of another batch of leaked passports, from a few years ago. A family member was booking a school tour, when he noticed the URL of the Travel CRM included an id number. Sure enough, the CRM would return all his details given only the (sequential) id number without a need for credentials: high resolution passport scan, and all the other details provided when booking an overseas trip. He notified the CRM company, and that email was ignored. He emailed again, proposing disclosure, and the problem was silently fixed with no response. A few months later he mentioned it to the school, along with the fact that he had followed up and had the vulnerability fixed. The school went straight into panic mode, called him to the principal's office and forced him to write a statement so they could refer him to the Feds. I intervened, explaining that he was the good guy who got the vulnerability fixed, and the problem was the school's, since they had supposedly vetted the CRM for security when choosing a tour company. All of a sudden from the school's point of view there was no problem and no need to mention it to any of the people whose information had been disclosed, despite my insistence. The people still haven't been notified. The school did acknowledge that the family member had done the right thing and verbally thanked him, but would not put anything in writing. The people involved in the tour had their details leaked, but there was nothing special about those people in the system, so realistically every person whose details were in that CRM had their details, including passports, leaked. It was a major travel CRM provider, so the number of people in the system would have been 6 or 7 figures. The kicker is that the family member was employed by a software company that had the school system as a customer. The IT person who was responsible for vetting the travel CRM (and had verbally thanked him) arranged for the school system to phone his employer and deliver an ultimatum: that the family member be sacked or they would risk losing a customer. The family member got the sack.
  • gomoboo 4mo ago
    After all of that why protect the company by not mentioning their name?
    • throwaway692675 4mo ago
      Because it's not worth it. I'm protecting the family member, not the company. The image of people standing up for the noble whistleblower is far from the truth. Disclosing the company here won't achieve anything apart from garnering a few karma points and generating some short lived outrage at the company. I'd consider disclosing it to the ICO, and made tentative steps in that direction at the time, but it's not clear that they are interested and whose interests they would protect. Here's a question that might make this discussion useful: What is people's experience of reporting data breaches to the UK's ICO? In your case, was meaningful action taken by the ICO and was the person doing the reporting protected? .
• hahahaa 4mo ago
  The cannabis link makes it much worse as you have a bit of information about the person in addition to the passport which is a perfect ID.
• JSR_FDED 4mo ago
  Well this should keep the transfer stations going for a bit longer.
• monksy 4mo ago
  Don't forget to send your congress person a reminder about what their vote for age verificiation systems does. Find your rep at congress.gov. Email or mail them this article.
• dang 4mo ago
  [stub for offtopicness]
  • dgellow 4mo ago
    Could we update the link to the original article? https://cambridgeanalytica.org/data-breaches-scandals/passports-driver-licenses-exposed-public-internet-2026-51096/ https://cambridgeanalytica.org/data-breaches-scandals/passpo...
    • ericpauley 4mo ago
      CA article is just AI;dr on a two week old Verge article: https://www.theverge.com/tech/947157/passports-data-breach-cannabis-club-systems-nefos-puffpal https://www.theverge.com/tech/947157/passports-data-breach-c...
      • dgellow 4mo ago
        Ok, then changing the link to the verge article. Thanks for pointing that out
        • wolvoleo 4mo ago
          The verge is not a good source as it's pay walled
          • gavinsyancey 4mo ago
            From the HN FAQ: > Are paywalls ok? > It's ok to post stories from sites with paywalls that have workarounds. > In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic. More here. https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html You can pay for the paywall, or there are ways around.
    • wolvoleo 4mo ago
      Wow it's insane that Cambridge Analytica is still around after the scandals.
• siar 4mo ago
  In EU, eIDAS 2.0 will fix all of these issues and future leaks alltogether. Check authbound.io
  • ale42 4mo ago
    Looks like this only works on smartphones? Well... no thanks.
    • lifestyleguru 4mo ago
      Duh, and only on iOS and Android ones, and only on their latest versions... but don't worry they have good intents I would trust them.
      • mrweasel 4mo ago
        This is the problem with pretty much all of the EUs attempts of getting away from US infrastructure. One of the VISA/MasterCard alternative is also a bloody app, on a smartphone, with an operating system from one of two US software gigants (One of which is know to give zero fucks about privacy). If the EU wants to continue down this road, step on has to be a mobile operating system. Avoiding tying solution to people phones would be better.
        • lifestyleguru 4mo ago
          The second part of my comment was /s. I wish banks, institutions, and governments would fuck off from my smartphone. Best I can do for them is web browser and email, if they want to be on my smartphone then do a mobile website.
    • dabber21 4mo ago
      how did you come to this conclusion? its not even true Edit: if it is only about authbound, maybe. But they are not the only ones offering this service
      • 4mo ago
• stef25 4mo ago
  Back when S3 buckets were rarely protected, I found hundreds of passports of people operating in the diamond business here in Antwerp. In another one I found all passports that had been scanned by a hostel in Bangkok.
• lifestyleguru 4mo ago
  Ahh so that's what they mean at the reception when they take photo of my ID and say "it's for the police". So that any police anywhere can freely download it at any time!
  • aand16 4mo ago
    While visiting Italy I've had the hotel photocopy my ID. I've researched and the legal requirement for the hotel is to fill a form on the police website, nothing more. While doing the checkout I've pressed them on the reason for keeping the photocopy ("is it for identity theft? "), the duration they were going to keep the copy etc. Basic info they were bound to disclose because of GDPR _before_ the data processing, which of course never happened. Turns out the local policemen asked verbally to make photocopies, just in case... The hotel is more afraid of the local police than of it's clients, so they just do it. Since I was the only client who ever asked about it, and gaslighting me wasn't going to work ("everybody does it! what do you have to hide?"), they just gave me the copy to destroy. Other places copy IDs because they're lazy and don't want to compile the required form on the spot. Not to mention ID photocopies floating around the reception desk in plain sight...
    • lifestyleguru 4mo ago
      > Turns out the local policemen asked verbally to make photocopies, just in case... The hotel is more afraid of the local police than of it's clients, so they just do it. In Italy occasionally they find mafia members hiding for years in... their home regions or even villages. They absolutely keep it "just in case" and I would trust their local police /s.
    • chrisjj 4mo ago
      > Since I was the only client who ever asked about it Says... this perpetrator?
      • aand16 4mo ago
        Guilty as charged. I often perpetrate actually
• rkagerer 4mo ago
  I have a real problem with the pretense posed by the article that the club has no blame. They should have understood the risk they were taking on by subcontracting a vendor to collect passports, and better vetted that vendor. Obviously the service provider was completely inept, but that doesn't absolve the fools using them. I preach to my clients this sort of PII should be treated as a toxic, hazardous substance. Ideally don't touch it with a 10 foot pole, and if you can't help it then limit the scope, protect it with strong access policies that severely limit who can touch it (including encryption keys conservatively custodied), and securely delete it all as soon as possible. Too many companies these days point you to shoddy third parties for some kind of functionality (e.g. book an appointment, perform KYC on you, host the online learning platform for your course, etc.), inappropriately foisting both a new business relationship on you that you never asked for along with their partner's terms of service that you have no bargaining power in negotiating. This is a side-effect of the SaaS era, and the model is broken.
  • beaker52 4mo ago
    [flagged]
    • aand16 4mo ago
      I wish people stopped using distracting animations below the text I'm trying to read and comprehend.
      • chrisjj 4mo ago
        I take it as entertainment for a target audience substantially unable to comprehend the text. This helps me decide to pass on this provider.
  • jwr 4mo ago
    If these kinds of breaches were actually costly, then people would indeed treat PII as toxic. But they aren't. The media brouhaha blows over within a week or so, and things are fine again. Leaking PII should be very, very expensive, and then this idiocy would stop.
• elAhmo 4mo ago
  > This should be a wakeup call for data security. Hah, author is funny.
• michelvilsen 4mo ago
  [dead]
• kleiba2 4mo ago
  I said if before, and I'll say it again: as long as they're is nothing to fear, companies will continue being lax with your valuable private data. As long as there's no liability, there's no incentive to care.
  • vaylian 4mo ago
    And they will continue to ask for data, that they don't actually need like phone numbers and home addresses.
• w3ll_w3ll_w3ll 4mo ago
  We should stop treating digital pictures of physical documents as some sort of crdentials. There is a reason why numerous security features are embedded in physical documents like watermarks, holograms and NFC. That's so the authenticity can be inspected in person. A picture has none of those, so it should not be treated as a credential.
  • mrweasel 4mo ago
    Different countries handle these things differently, but it's honestly surprising to me that a photo of a passport or drivers license have any value. It provides no security, so why would anyone ever accept it a proof of identity?
    • notpushkin 4mo ago
      > It provides no security, so why would anyone ever accept it a proof of identity? Because there is no other universal method that works online, and because companies don’t really care about identity verification – they just need something “good enough” so that they can say “hey, we’ve followed industry standard protocols, how could we have known this passport scan was photoshopped?” And to be honest I think it’s for the best. I really don’t want to be scrutinized even more online (and give even more personal data so it gets leaked a couple years later).
      • mrweasel 4mo ago
        There's certainly a point to reducing scrutiny online. However when companies are forced to do this verification, I just question why a photo of a password is considered "good enough", when it clearly isn't. I don't think you should be able to do anything with your passport online. That's a document that should only have value if you're actively holding it in your hand.
  • Tangurena2 4mo ago
    > We should stop treating digital pictures of physical documents as some sort of credentials. This is how biometric "authentication" works - you slide a picture (of a face, or maybe a fingerprint or hand geometry) under a door, and the guard on the other side of the door looks at the picture, maybe compares it to some database somewhere and then says PASS/FAIL. Maybe the device taking the picture has some sort of cryptography to prevent yourself from shoving a picture of some authorized person. Usually not. People keep trying to find the correct magic spell to make biometrics "foolproof". That's a waste of time. Blackhat/DEFCON type conferences were showing people how to make fingerprints out of (the gelatin that makes) gummy bears back in the late 90s. Make them thin enough and you can fool pulse detection (carjackers in some Asian countries were chopping fingers off to bypass theft deterrent systems that used fingerprints).
• dabber21 4mo ago
  I will never upload a picture of my passport or id online, ever. I only recently started IDing myself online via eID (german) if available, before that it was usually that I went to the post office and get verified there
  • ExoticPearTree 4mo ago
    It is not an option in every country to do what you do. Thinking of it, its probably a quirk if Germany that you can go to a Post Office to be “verified”.
• m00dy 4mo ago
  >>But how could the company be so careless? Generally, these systems are designed by people whose only goal is to make money. Security is just treated as a liability until shit actually hits the fan.
• roysting 4mo ago
  That reminds me of the insanity in places like Spain where they want your passport or resident information for every little thing. We really need to start building a new form of “Democracy” in the backbone of not only that anything that the ruling class wants to apply to everyone else needs to be first implemented on themselves so to double the degree, but that all politicians, bureaucrats, and even contractors need to be bonded against their personal wealth for things they say, promise, contract, or agree to. It is high time that liars, cheats, frauds, and thieves just get to get away with little more than a shoulder shrug and their billions on plunder and lies.
• 17761989 4mo ago
  [dead]
• anotheraccount9 4mo ago
  I'm sorry to say this, but most people don't care. Most governments don't care. Companies don't care. Not that it's not important. But protecting people's ID is at the lower part of the list for most organizations. There are hardly any consequences. Leaking PII is still a joke nowadays.
• sylware 4mo ago
  IDs fest for scammers and fraudsters.
• hephios 4mo ago
  nice for fable 5
• tufy123 4mo ago
  "Let’s hope this is a wakeup call." Narrator: it was, unfortunately, not a wakeup call...
• tufy123 4mo ago
  > Let’s hope this is a wakeup call. Narrator: it was, unfortunately, not a wakeup call...