An Ohio-based company that processes medical marijuana recommendations left nearly 1 million records containing highly sensitive personal information in a publicly available database, WIRED reported.
The data left unsecured by Ohio Medical Alliance LLC, which does business as Ohio Marijuana Card, included medical histories and Social Security numbers of medical cannabis patients, according to the magazine.
Security researcher Jeremiah Fowler first made the discovery in July.
Ohio Marijuana Card appears to have removed the data after Fowler contacted the company, according to WIRED.
Reached briefly via telephone on Wednesday, company President Cassandra Brooks declined to comment to MJBizDaily pending the results of an internal investigation.
“There is no statement at this time until the investigation is done,” she said.
The situation is one of the most significant marijuana-related data breaches to date.
It’s also a rare example of a longstanding fear voiced by medical marijuana patients: Their information appears on a “list” when they attempt to register as a patient to comply with state medical cannabis laws.
According to WIRED, medical cannabis patient data left unencrypted and accessible without a password included:
- Dates of birth.
- Email and physical addresses.
- Medical histories and mental health evaluations.
The incident does not yet appear to have drawn attention from authorities.
Other examples of data breaches have affected adult-use cannabis companies as well.
In January, major California-based brand Stiiizy announced that some customer information leaked when a third-party vendor had experienced a data breach.
Following a general trend, MMJ patient enrollments are declining significantly in Ohio since the launch of adult-use sales a year ago.
Medical Disclaimer:
The information provided in these blog posts is intended for general informational and educational purposes only. It is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or other qualified healthcare provider with any questions you may have regarding a medical condition. The use of any information provided in these blog posts is solely at your own risk. The authors and the website do not recommend or endorse any specific products, treatments, or procedures mentioned. Reliance on any information in these blog posts is solely at your own discretion.
