Vaccine passport app Portpass, which has 650,000+ registered users across Canada according to the company's CEO, had a security flaw exposing private user info
Sarah Rieger / CBC News : Tweets: @tommy_slick , @sarahcrgr , @sarahcrgr , @bonstewart , @francesca6365 , @dartmouthderek , and @tylerrdawson Tweets: Tom Ross / @tommy_slick : Huge no bueno right here. I put my info into the app (after reading the privacy policy too), and now with the system unresponsive I cannot seem to be able to remove that info. https://twitter.com/... Sarah Rieger / @sarahcrgr : I waited to publish this story until I notified the company, so it could have time to protect people's information. Portpass' CEO says the data has been pulled, his team is investigating, and he'll be notifying the privacy commissioner's offices: https://www.cbc.ca/... Sarah Rieger / @sarahcrgr : I received a tip last night that proof-of-vaccination app Portpass had left users' personal information exposed. I was able to easily view names, contact info, blood type, and most concerning, photos of their driver's licences or passports. https://cbc.ca/... Bonnie Stewart / @bonstewart : LOUDER FOR THE PPL IN THE BACK...third party apps are NOT the way to go with public health info. https://twitter.com/... Francesca / @francesca6365 : “The breech lasted only for minutes.” Should be fine. https://www.cbc.ca/... @dartmouthderek : It concerns me that we are 6 days away from proof of vaccination supposedly being required, and we still don't have important details, including how privacy will be protected. https://twitter.com/... Tyler Dawson / @tylerrdawson : The security risks of vaccine passports systems seem, generally speaking, to have received less attention than they deserve https://twitter.com/...
Context & Ripple Effects
The Portpass exposure lands in a crowded file on pandemic-era health software. Earlier reporting catalogued the design problems facing vaccine passport builders — forged records, privacy, interoperability — and a hands-on review of New York's Excelsior Pass found low adoption alongside persistent technical glitches. As cities moved to mandate proof of vaccination in summer 2021, the state of vaccine passport apps was already drawing privacy and accuracy concerns.
First-order effects
- More than 650,000 Canadian registrants had sensitive data left accessible — names, contact info, blood type, and photos of driver's licences or passports — before the CEO says his team pulled the data and began investigating.
- Users who entered information in good faith, such as those now unable to delete their records while the system is unresponsive, have no immediate way to revoke what they submitted.
Second-order effects
- Canada's privacy commissioner offices, which the CEO says he will notify, are the same enforcement channel that found coffee chain Tim Hortons illegally collected location data via its own app — a precedent pointing toward formal scrutiny of Portpass.
- Venues and governments leaning on private passport apps to enforce vaccination mandates now carry the reputational cost when a vendor leaks; the incident hands skeptics concrete evidence that verification infrastructure is not ready.
Third-order effects
- If the pattern holds, the rush-deploy-then-patch cycle seen since countries first fielded complaints over coronavirus-tracking software becomes the case for mandatory security audits and consent standards baked into any future digital health credential regime.
- Health-credential apps may consolidate around fewer, better-audited platforms as governments grow unwilling to outsource compliance-critical data handling to small vendors.
The trend: Pandemic-era health credential apps are colliding with the same privacy reckoning that hit contact-tracing software, pushing regulators toward enforceable standards for government-linked consumer data.