Nearly 1M Passports and Photo IDs Exposed on Public Internet

Typing a few simple characters into a browser bar, I suddenly found myself staring at the personal identity documents of strangers from around the world. There was a young woman’s German passport, a Spanish man’s passport with glasses perched on his head, and the front and back of another individual’s driver’s license, complete with a goofy expression. These documents were all sitting on public URLs with no password protection or access controls whatsoever. If I shared the link with you, you could instantly view someone’s passport.

This massive data exposure involved nearly 1 million passports and photo IDs, all left exposed on the public internet. The documents belonged to customers of a cannabis club management system, highlighting a critical security vulnerability in how sensitive identity data is stored and served online.

“We have to do something about it as fast as possible, because people will find this and resell it. It will do damage,” warned Sammy Azdoufal, a security researcher who discovered the breach. The exposed data included high-resolution scans of passports, driver’s licenses, and other government-issued identification, all accessible without any authentication.

The breach underscores the growing risk of cloud misconfigurations and the urgent need for companies handling sensitive personal data to implement robust encryption and access controls. In this case, the documents were simply stored in publicly accessible cloud storage buckets, making them easy prey for anyone who knew where to look. For the individuals whose identities are now exposed, the consequences could range from identity theft to financial fraud, as criminals often purchase and trade such documents on underground markets.