Medical marijuana provider Ohio Medical Alliance leaks one million patient records
Learn More
Cybersecurity researcher Jeremiah Fowler discovered and reported an exposed database that contains 957,434 records belonging to Ohio Medical Alliance LLC (OMA), an Ohio-based organization operating under the brand "Ohio Marijuana Card".
Ohio Medical Alliance is a telemedicine and in-person provider that provides evaluations for a wide range of qualifying health conditions through state-licensed doctors. ccording to their website, OMA has helped over 330,000 patients nationwide access medical marijuana.
Fowler sent a responsible disclosure notice to OMA, and the database was restricted from public access the following day. The researcher did not receive any reply to the responsible disclosure notice.
The majority of files in the two databases were in PDF, JPG, and PNG formats, with one CSV document named "staff comments" containing a large amount of internal communications, notes about clients, appointments, status, and personal situations. The exposed records exposed data includes:
- High-resolution images of driver's licenses and identification documents
- Names and physical addresses
- Dates of birth and license numbers
- Patient intake forms and medical records
- Medical release forms
- Physician certification forms containing Social Security numbers
- Mental health evaluations including PTSD and anxiety conditions
- Medical documents indicating patients' diagnoses and reasons for seeking medical marijuana prescriptions
- Approximately 210,620 email addresses of clients and internal employees or business partners
- Internal communications and staff comments about clients, appointments, and personal situations
The number of affected individuals is not disclosed. The number of exposed records is 957,434 but it's not certain that each record pertains to a different patient. At least 200,000 individuals are exposed based on the exposed clients and partners.
It is not known if the database was owned and managed directly by OMA or by a third-party contractor, how long the database was exposed before discovery, or if anyone else may have gained access to it.
No official statement or notification has been published by Ohio Medical Alliance regarding this incident. The company has not disclosed whether law enforcement or regulatory authorities have been notified about the data exposure.
