UK medical cannabis clinic CB1 Medical reports data breach exposing over 4,000 patient records
Learn More
CB1 Medical, a UK medical cannabis clinic, is reporting a significant data breach that exposed patient of over 4,000 individuals.
The breach appears to be caused by an inadvertent exposure of an old data export rather than a malicious cyber attack. The breach is not thought to be the result of a cyber attack and there is 'no evidence of wider sharing or misuse'. A user reported the issue via a Reddit post after "being alerted by Google", probably through Google Alerts that shares new indexed pages that mention a search string and the string was that person's name or email.
The leaked information was contained in a 2,600-page PDF documen. Independent data analysis by affected patients revealed the breach impacted 4,384 unique emails and 4,299 unique phone numbers.
The exposed data includes
- Contact details (email addresses and phone numbers)
- Dates of birth
- Prescription information covering a six-month period
- Details of prescribing doctors
- Appointment times and scheduling information
The clinic notified affected patients via email on Monday, August 18, 2025, and has reported the incident to the Information Commissioner's Office (ICO).
The clinic says it took 'immediate steps' to secure the removal of the information from the hosting website and has commenced an investigation. Anabel Sharma, Chief Operating Officer for CB1 Medical, stated the clinic is "deeply sorry" for the concern caused by the incident.
