Massive Data Exposure: Over 985,000 Photo IDs Left Unprotected in Cannabis Club Software Breach Security researcher Sammy Azdoufal uncovered a severe data exposure involving over 985,000 photo IDs, including passports, driver’s licenses, and personal details, left publicly accessible on the internet due to critical security flaws in software used by cannabis clubs in Spain. The breach, discovered in May, stemmed from Cannabis Club Systems (CCS), an Irish company formerly known as Nefos Solutions, which provides verification and management software for cannabis clubs. Azdoufal, who previously exposed vulnerabilities in DJI robot vacuums and baby monitors, found that CCS’s systems stored sensitive documents at unprotected public URLs, requiring no authentication to access. The exposed data included names, phone numbers, home addresses, cannabis consumption habits, and even selfies affecting visitors from over 30 countries, including 30,000 U.S. citizens and reportedly some celebrities. The issue originated from CCS’s PuffPal app, which clubs used for member verification via QR codes. Azdoufal’s investigation revealed hardcoded Stripe API keys, unsecured admin portals, and weak club passwords that could be cracked with minimal effort. Even after initial fixes, CCS temporarily re-exposed data to accommodate club complaints, prioritizing functionality over security. Following pressure from Azdoufal and media inquiries, CCS shut down PuffPal and vulnerable APIs on June 10, securing the exposed IDs. The company has since reported the breach to Ireland’s Data Protection Authority (DPC), though it missed the 72-hour GDPR disclosure deadline, risking fines. CCS co-founder Andreas Nilsen acknowledged the lapse, blaming an outsourcing firm, 9Series, for the flawed development but taking responsibility for the oversight. While Nilsen claims no evidence of malicious access beyond Azdoufal’s findings, the incident highlights widespread risks in third-party software security, echoing a similar breach last month where a UK visa portal exposed 100,000 passports via unsecured URLs. CCS plans to replace PuffPal with a independently audited app and has severed ties with 9Series.