Nearly a million cannabis social clubs and coffee shops had their personal data exposed on the Internet for several weeks.
The breach comes from CCS Nube, the SaaS platform developed by Cannabis Club Systems (CCS), the business unit of the Irish company Nefos Solutions Ltd, used by 377 establishments in over 40 countries to manage memberships, identities and transactions.
The Sammy Azdoufal, a cybersecurity researcher and himself a member of a Barcelona club, who discovered the flaw in April 2026 after downloading his club’s optional mobile application, PuffPal, and decompiled the code.
The exposed database would have contained information on 1,082,680 registered members, of which nearly 986,000 identity documents such as passports, national identity cards and driving licenses. More than 104,000 French citizens are among the users concerned.
The database includes some of the best-known clubs in the sector, including Amsterdam Bulldog with 53,011 profiles, or the Strain Hunters of Barcelona, the Choko, the Firehouse or the Selva.
