Canadian vaccine passport app exposes user data

According to CBC News, data including names, identification documents and email addresses were left unsecured on the PORTpass website. 

Following a tip received on Monday, CBC News investigated the website and verified that app user’s information, among others: “Email addresses, names, blood types, phone numbers, birthdays, as well as photos of identification like driver’s licenses and passports can easily be viewed by reviewing dozens of users’ profiles.”

Allegedly the data was stored in plain text and could be accessed by the public. 

Zakir Hussein, Chief Executive Officer for PORTpass reportedly denied that the app was experiencing security issues that same day, however, the app’s website has since been taken offline.

The following day, Hussein stated that the breach only lasted for minutes, despite the news outlet pointing out it had reviewed the personal information for more then an hour. 

“Someone that’s out there is trying to destroy us here, and we’re trying to build something good for people,” Hussein said. 

“There’s holes, and what I’m realizing is I think there are some things that we need to fix here. And you know, we’re trying to play catch-up, I guess, and trying to figure out where these holes are.”