Sensitive Medical Cannabis Data Breach Exposes Patient Information

The expansion of cannabis use for both recreational and medicinal purposes across the United States has led companies to collect extensive personal data from their clients. The data required for medical marijuana cards is particularly sensitive due to the health information applicants must provide. Recently, patients in Ohio who use medical marijuana faced potential exposure of their private data due to a security lapse.

Discovery of the Data Breach

In July, security researcher Jeremiah Fowler uncovered an unprotected database online. This database seemed to hold numerous medical records, mental health evaluations, physicians' notes, and ID images like driver's licenses from individuals applying for medical cannabis cards. This vast 323GB database contained nearly a million records, with details such as Social Security numbers, email and home addresses, birthdates, and sensitive health information, organized under individuals' names.

Link to Ohio Medical Company

Evidence within the database pointed to Ohio Medical Alliance LLC, which operates under the name Ohio Marijuana Card, as the possible owner. Fowler reached out to the company on July 14th, and by the next day, the database had been secured, no longer visible to the public. However, Fowler did not receive confirmation regarding his alert.

Company's Response

Ohio Medical Alliance did not directly address questions about the exposed data. However, Cassandra Brooks, the company's president, did mention in an email that they were taking the matter seriously and were in the process of investigating the alleged incident.

Vulnerable Information

Fowler described seeing physician reports outlining medical conditions like anxiety, cancer, and HIV, which were used to validate applicants' eligibility for medical marijuana use. Additionally, applicants had submitted formal identification, including offender release cards used for identity verification to acquire cannabis cards, adding to the database's sensitive content.

Nature of the Leaked Data

The data was primarily in image formats such as PDF, JPG, and PNG. A document titled 'staff comments' in CSV format appeared to be an export of internal logs, detailing client interactions, appointment notes, and application statuses. It contained over 200,000 email addresses linked to Ohio Medical Alliance clients, staff, and partners.

The Wider Issue of Data Mismanagement

Incidents of misconfigured databases being inadvertently exposed on the internet continue to be a significant issue. Despite ongoing efforts to raise awareness and improve data protection practices, such vulnerabilities remain prevalent, posing serious privacy risks.