Cybersecurity Researcher Uncovers Over 957,000 Medical Cannabis Patient Records on Unsecured Database

OG Article By TG Branfalt Watch Today's LIVE Episode on X, and Rumble

and Youtube

August 21 2025

A cybersecurity researcher has discovered a public and unencrypted database containing the personal records of over 957,000 Ohio medical cannabis patients.

A cybersecurity researcher has uncovered a public, unencrypted, and non-password-protected database that contains 957,434 personal records of medical cannabis patients. Jeremiah Fowler on Tuesday published the findings that records held by Ohio Medical Alliance LLC (OMA) – an organization that helps individuals obtain medical cannabis ID cards in the state – were exposed. 

The records – 323 GB in all – include images of driver’s licenses or ID documents from multiple states that contain names, physical addresses, birthdates, and license numbers and folders that were labeled with patients’ first and last names, contained intake forms, medical records, release forms, physician certification forms that included social security numbers, and mental health evaluations. 

“The majority of files I saw in the two databases were in PDF, JPG, PNG formats. One CSV document named ‘staff comments’ contained a large amount of internal communications, notes about clients, appointments, status, or personal situations. That document also contained an estimated 210,620 email addresses of clients and internal employees or business partners.” — Fowler in a Website Planet post 

Fowler indicated he sent a disclosure about his findings to OMA – which operates under the Ohio Marijuana Card brand – but did not hear back; however, that the database was restricted from public access the following day and no longer accessible.