US tech website The Verge<\/a> reported that hundreds of thousands of passports for people who used cannabis clubs in Spain could be accessed via a \u2018backdoor\u2019 into its database.<\/p>\nThe issue came to light after a security researcher allegedly discovered the multitude of passports and IDs sitting unprotected at public URLs, reportedly with no password access required.<\/p>\n
This happened, according to The Verge, because a \u2018secret key\u2019 for processing payments was sitting inside an app used by the cannabis clubs.<\/p>\n
Brian Honan, a Dublin-based security expert who works across the public and private sector, told The Journal that this can be an all too common occurrence in instances where data was inadvertantly shared.\u00a0<\/p>\n
\u201cIt\u2019s basically like somebody has put the key under the doormat, but anybody with access to the doormat can get in. It isn\u2019t good practice to have your key stored in the application,\u201d Honan said, referring to the report containing the allegations.<\/p>\n
Nilsen had said in the initial report that there was no evidence that any outsider accessed the data other than the security researcher who discovered the open database.<\/p>\n
He added to that the company would \u201ccommunicate to everyone that was potentially exposed\u201d.<\/p>\n
GDPR risks<\/p>\n
Honan, the data security analyst, warned that companies could face hefty fines if data is found unsecured, as passport leaks could place people at the mercy of scammers.<\/p>\n
Honan noted that the use of the cannabis could be categorised as for medicinal purposes, which Spanish cannabis clubs include as part of their membership.<\/p>\n
Under GDPR legislation, Honan said that the health data would be deemed to be particularly sensitive, especially if it was \u201cfreely available on the internet\u201d.<\/p>\n
\u201cThere is obviously a lot of sensitive, personal data stored in that system. People\u2019s IDs give a lot of information and that can be of use to criminals for scams,\u201d Honan said.<\/p>\n
Given the Spanish system allows people to buy cannabis, their country of origin and the laws in place around drug use in those jurisdictions could also be a factor in any risk.<\/p>\n
\u201cThe individuals themselves could be at risk, either potentially from scammers who could blackmail you because they have that information, or authorities who could come across that information,\u201d Honan added.<\/p>\n
The EU\u2019s GDPR laws can carry tough punishments for health data breaches, with penalties of up to \u20ac20 million or 4% of global annual turnover a danger to a company.<\/p>\n
When asked how common such alleged data breaches, as seen in the Spanish cannabis clubs can be, Honan said they remain an issue for many companies handling sensitive information.<\/p>\n
\u201cThe challenge we have is that we have many developers who are very good at writing code, but writing secure code is not as widespread as it should be,\u201d Honan said.<\/p>\n
\u201cThe onus is not just on the company developing an application or software securely, but under GDPR the company providing the application and the company requesting the development are required to build in privacy and security by design.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"VULNERABILITIES FOUND IN an online database may have seen as many as 12,000 Irish passports sitting in the…\n","protected":false},"author":2,"featured_media":626031,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[11314,265783,103867,61,60,39347,2846,112,11259],"class_list":["post-626030","post","type-post","status-publish","format-standard","has-post-thumbnail","category-sports","tag-cannabis","tag-cannabis-social-clubs","tag-drug-use","tag-ie","tag-ireland","tag-security-concerns","tag-spain","tag-sports","tag-the-morning-lead"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/626030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=626030"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/626030\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/626031"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=626030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=626030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=626030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"an-interior-view-of-the-420-smokers-club-in-barcelona-spain-27-december-2015-the-city-of-barcelona-is-concidering-steps-to-regulate-the-consumption-of-cannabis-hashish-and-marijuana-photo-ger\"](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/09\/1789531212_263_.JPEG\")