GoKawiilA journalist typing a few letters and numbers into a web browser pulled up the passport of a young woman from Germany. Then a Spanish man’s passport. Then another man’s driver’s license. All of it sitting on the public internet with no password, no encryption, no access control whatsoever.
Nearly a million passports and photo IDs from multiple countries were exposed across unprotected public URLs, accessible to anyone with a link. The documents remained discoverable this way for months, according to reporting by The Verge, before being taken offline. The exposure represents one of the largest identity document breaches in recent memory—and it happened because of a fundamental failure in data security practices.
Key Findings: The Scale: Nearly one million passports and photo IDs from multiple European countries were left completely unprotected on public web servers.
Nearly one million passports and photo IDs from multiple European countries were left completely unprotected on public web servers. The Access Method: No hacking was required—documents were accessible through direct URLs with zero authentication or encryption.
No hacking was required—documents were accessible through direct URLs with zero authentication or encryption. The Timeline: Identity documents remained publicly accessible for months before discovery, creating an unknown window of potential criminal exploitation.
The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. The infrastructure storing these identity documents—full passport scans, driver’s licenses with photos, names, and identifying numbers—was left completely unprotected on publicly accessible web servers.
Sammy Azdoufal, a security researcher who discovered the exposure, told The Verge the urgency was acute: “We have to do something about it as fast as possible, because people will find this and resell it. It will do damage.” The concern was not theoretical. Identity documents at scale on the open internet are immediately valuable to criminals. According to guidance from the Federal Trade Commission, stolen passports and driver’s licenses fuel identity theft, document fraud, and account takeover attacks.
How Did Nearly a Million Identity Documents End Up Unprotected?
What makes this breach structurally significant is not just the volume of documents exposed, but the mechanism of exposure: a company collecting identity verification data—ostensibly for legitimate age-gating purposes—stored that data in a way that treated security as optional. No authentication layer. No rate limiting. No encryption. Just raw identity documents, URL-accessible to the entire internet.
The Security Failures:
... continue reading