The passport details of up to 12,000 Irish citizens may have been left exposed in an online database, raising fears of identity fraud.
Here is what we know, and what to do if you could be affected.
What happened
Around 12,000 Irish passports were potentially left visible in an unsecured online database, according to reporting by The Journal.
The Irish records are understood to be part of a far larger cache of almost one million passports and photo IDs from around the world that could be publicly accessed for a period, believed to be in May and June, and possibly longer.
The exposure was uncovered by a security researcher. Alongside the Irish passports, the records are reported to have included more than 50,000 belonging to British nationals.
Who is affected
The passports are believed to belong to people who signed up as members of so-called cannabis members’ clubs in Spain.
These private clubs commonly ask prospective members to prove their identity and age, sometimes by handing over a passport, when they register.
So if you handed over your passport to join one of these clubs while in Spain, your details may be among those exposed.
The data and the response
The data was managed by an Irish-registered software firm, Cannabis Club Systems, also known as Nefos Solutions.
The company has said there is no evidence that any outsider accessed the data after the vulnerability was first reported.
The Data Protection Commission has said it has been engaging with the company since the allegations emerged.
The concern for those affected is that passport details in the wrong hands can be used for identity fraud, and unlike a password, a passport cannot simply be changed.
What to do if you think you’re affected
If your physical passport is still safely in your possession, the main risk is identity fraud, so be alert to unexpected contact, phishing emails or texts, and any suspicious activity on your accounts.
Never hand over further personal details in response to an unsolicited message.
If a passport has actually been lost or stolen, report it through the official channels without delay. Irish citizens abroad can follow the guidance of the nearest Irish embassy.
*This article was originally published on Extra.ie.