Thousands of Irish passport records linked to cannabis clubs in Spain may have been left publicly accessible online following a serious security failure affecting almost one million members.
Up to 12,000 Irish passports are understood to have been included in the exposed database, alongside approximately 30,000 documents belonging to US citizens.
The records were collected by private cannabis clubs operating across Spain, where members are required to register and provide proof of identity and age before being admitted.
Unlike Amsterdam-style coffee shops or commercial dispensaries, Spanish cannabis clubs generally operate as private, members-only associations. Estimates suggest there are between 1,000 and 2,000 such establishments across the country.
The clubs use specialist software to manage memberships, verify identification and record transactions. Reception staff can upload passports and other identity documents to a cloud-based system for verification.
The affected platform was operated by Cannabis Club Systems, also known as Nefos Solutions, an Irish-registered software company with an address in Dublin.
Security weaknesses may have left approximately 985,000 passports and photographic identity documents accessible through public internet addresses during May and June, and possibly for longer.
The problem reportedly arose after a secret digital key used for processing payments was found within an application provided to cannabis clubs. A security researcher is said to have discovered that the key could be used to reach documents stored at publicly accessible addresses without requiring a password.
The Irish Data Protection Commission has confirmed that it is engaging with the company. However, the regulator has not made any finding of wrongdoing.
Cannabis Club Systems temporarily suspended parts of its platform after being alerted to the security concerns. The company said the identified vulnerabilities had been repaired and that the previously exposed access points were no longer available to the public.
It also said it had found no evidence that personal information had been publicly distributed or accessed by anyone other than the security researcher who reported the problem. An investigation into whether there had been any earlier unauthorised access remained ongoing.
Cybersecurity specialists have warned that exposed passports could provide criminals with valuable information for identity theft, financial fraud and targeted scams.
The connection between individual passport holders and cannabis clubs could create additional risks. Some victims might face attempted blackmail, particularly if cannabis use is illegal or heavily restricted in their home countries.
The information could be even more sensitive where club membership relates to medicinal cannabis use. Under European data-protection legislation, information revealing an individual’s health or medical circumstances is given a particularly high level of protection.
Companies that collect or process personal information are required to incorporate privacy and security protections into their systems from the outset. Responsibility can extend both to the software provider and to the organisation using the platform.
Serious breaches of the EU’s General Data Protection Regulation can result in penalties of up to €20 million or four per cent of a company’s worldwide annual turnover, whichever is higher.
Security experts have also warned that embedding access credentials within an application is poor practice because anyone capable of examining the software may be able to locate and misuse them.
Cannabis Club Systems said protecting confidential information remained one of its highest priorities and that it was continuing to strengthen its security systems and governance procedures.
The full number of people affected—and whether criminals accessed or downloaded any of the exposed records—has not yet been established.
