Nearly a Million Passports and Photo IDs Left Unprotected on the Public Internet via Cannabis Club App PuffPal

Close to one million government-issued passports and photo IDs submitted for age-verification were left exposed on the open internet by Nefos Solutions' cannabis club membership app PuffPal, according to The Verge. The documents were accessible without authentication, making the exposure one of the largest involving government identification documents reported in 2026. The incident highlights the risks of age-verification data collection by lightly-regulated consumer apps.