One Million Passports Leaked Online

Schneier on Security
Actively Exploited

Overview

A database containing nearly one million passport records from various countries has been leaked online. The breach occurred when a system used for verifying IDs at cannabis dispensaries was compromised. While the system itself is considered low-value, the credentials it stored—passports—are highly sensitive and valuable. This incident raises serious concerns about how personal information is handled, especially in sectors like cannabis, where security practices may not be as stringent. The leak puts individuals at risk of identity theft and further exploitation, emphasizing the need for better security measures in handling such important data.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Passport records from various countries
  • Action Required: Organizations should enhance security measures for low-value authentication systems, including stronger encryption and access controls.
  • Timeline: Newly disclosed

Original Article Summary

A database of almost a million passports from around the world was leaked online. Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk.

Impact

Passport records from various countries

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance security measures for low-value authentication systems, including stronger encryption and access controls.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Related Coverage

Think tank warns US markets face hidden infrastructure risks

SCM feed for Latest

A new report from the Institute for Critical Infrastructure Technology (ICIT) warns that the U.S. financial markets are at risk due to hidden vulnerabilities in infrastructure concentration. The report indicates that many critical systems are overly reliant on a small number of providers, which could lead to significant disruptions if those providers experience failures or attacks. This concentration poses a challenge to market resilience, as the interconnected nature of these systems means that a single point of failure could have widespread repercussions. The findings urge policymakers and businesses to address these vulnerabilities to ensure the stability and security of the market. Addressing these issues is crucial for maintaining public trust and the overall health of the economy.

Jun 26, 2026

NIST seeks public feedback on updated IoT security guidelines

SCM feed for Latest

The National Institute of Standards and Technology (NIST) has released a draft of updated guidelines aimed at improving the cybersecurity of Internet of Things (IoT) products used by the federal government. Titled 'IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements,' this draft is open for public comment until August 24. The guidelines are intended to set specific cybersecurity standards for IoT devices, which have become increasingly prevalent in both government and private sectors. By seeking feedback, NIST hopes to address potential security gaps and ensure that IoT devices meet certain safety benchmarks. This initiative is crucial as vulnerabilities in IoT products can lead to significant risks, including unauthorized access and data breaches.

Jun 26, 2026

FCC approves new cybersecurity rules for emergency alerts and undersea cables

SCM feed for Latest

The Federal Communications Commission (FCC) has approved new cybersecurity regulations aimed at enhancing the security of the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA). These systems, which are critical for disseminating emergency information to the public, are vulnerable to hijacking attacks. The new rules are designed to prevent unauthorized access and ensure that alerts sent during emergencies are authentic and reliable. This move comes as a response to increasing concerns about the potential misuse of these systems, which could lead to widespread panic and misinformation. By strengthening these regulations, the FCC hopes to protect public safety and maintain trust in emergency communication channels.

Jun 26, 2026

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

The Hacker News

A serious vulnerability in Amazon Q Developer was discovered, allowing malicious repositories to execute commands and potentially steal cloud credentials from developers. This flaw, tracked as CVE-2026-12957, received a CVSS score of 8.5, indicating its severity. The issue stemmed from the way Amazon's AI coding assistant interacted with Model Context Protocol (MCP) servers. Developers could unknowingly expose their credentials simply by opening a compromised repository and trusting its workspace. Amazon has since patched the vulnerability, emphasizing the need for developers to be cautious when dealing with untrusted code repositories.

Jun 26, 2026

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

The Hacker News

A newly discovered vulnerability in the Linux kernel, identified as CVE-2026-46331 and dubbed 'pedit COW', poses a significant risk by allowing unprivileged local users to gain root access on affected systems. This flaw resides in the traffic-control subsystem, specifically in the packet-editing action (act_pedit), which can lead to an out-of-bounds write that corrupts shared page-cache memory. The public release of a working exploit occurred just a day after the vulnerability was disclosed on June 16, raising concerns about its potential for exploitation. Red Hat has classified this flaw as important, emphasizing the urgency for users to assess their systems and apply necessary security measures. Given the rapid emergence of exploits, organizations using Linux systems should prioritize patching and monitoring for unusual activity to mitigate the risk of unauthorized access.

Jun 26, 2026

New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets

The Hacker News

A new privilege escalation vulnerability in the Linux kernel, known as DirtyClone, has been identified, allowing local users to gain root access by exploiting corrupted file-backed memory through cloned network packets. This flaw, tracked as CVE-2026-43503, has a CVSS score of 8.8, indicating a high severity level. JFrog Security Research demonstrated a working exploit for this vulnerability on June 25, marking the first public showcase of its kind. Users and organizations running affected Linux systems should be aware of the potential risks this flaw poses, as it can be exploited to take control of systems if not addressed promptly. A patch has been released to mitigate this issue, and users are encouraged to apply it as soon as possible to protect their systems.

Jun 26, 2026