A Better Newspaper

## Overview A data breach reportedly exposed roughly one million passports and other government-issued identification documents (such as driver's licenses) publicly on the internet, according to reports covered by The Verge and security researcher Bruce Schneier's blog (Schneier, June 2026). The breach has reportedly been linked to systems used by cannabis dispensary/club verification services — specifically named systems associated with entities referred to as "Cannabis Club Systems," "Nefos," and "PuffPal" (The Verge, 2026). These appear to be age/ID verification vendors used by cannabis retailers to confirm customer identity and age before sale. ## Why It Matters This incident highlights a recurring and escalating risk category: third-party identity verification vendors that collect and store sensitive government ID scans (passports, driver's licenses) as part of age-verification or compliance workflows, often with inadequate security controls. - **Regulatory exposure**: Age-verification mandates (including emerging EU and US state-level requirements) are pushing more businesses to collect scanned government IDs, creating a growing attack surface. - **Identity theft risk**: Passport and driver's license data is highly valuable for identity theft, human trafficking, and fraud schemes. - **Liability chain**: Retailers relying on third-party verification vendors may face liability even when the breach originates at the vendor level. ## What to Watch - Regulatory investigations into the specific vendors (Cannabis Club Systems, Nefos, PuffPal) and whether they face fines or lawsuits. - Broader industry scrutiny of ID-verification-as-a-service providers, especially as age-verification laws (e.g., EU VPN age verification push) expand the market for such services. - Potential class action litigation from affected individuals.