COLUMBUS, Ohio (WCMH) — A class action lawsuit has been filed against a company that helps patients in Ohio and five other states obtain medical marijuana cards after a massive amount of data was allegedly easily accessed online.
According to the complaint, cybersecurity researcher Jeremiah Fowler discovered a database containing 957,434 records amounting to 323 gigabytes of unencrypted and non-password-protected information. The files were believed to belong to Ohio Medical Alliance LLC, also known as Ohio Marijuana Card, a business that also serves Arkansas, Kentucky, Louisiana, Virginia, and West Virginia.
Fowler claimed that he made the discovery in July and informed the company about his online find. The database reportedly contained high-resolution images of patients' government identification, including driver’s licenses, intake forms, medical records, release forms, physician certification forms, Social Security numbers, mental health evaluations, diagnoses, and hundreds of thousands of email addresses.
“The majority of files I saw in the two databases were in PDF, JPG, PNG formats,” Fowler wrote in an online report about the find. “One CSV document named 'staff comments' contained a large amount of internal communications, notes about clients, appointments, status, or personal situations. That document also contained an estimated 210,620 email addresses of clients and internal employees or business partners.”
Estate of Ta’Kiya Young files federal lawsuit against Blendon Township, police chiefIn a response to the incident on its website, dated Sept. 22, Ohio Medical Alliance acknowledged it was contacted about the accessed files but stated that it was made aware on Aug. 15, not in July. The company said it “took immediate action to begin securing the system and investigate the event” and that third-party specialists were employed to help.
According to the company, parts of the “database were inadvertently left accessible by a third-party vendor while making changes to the database,” and there was no evidence that anyone beyond the cybersecurity researcher viewed or copied its files. It also noted that “information related to a limited number of individuals was potentially involved.”
The legal document suggests that the plaintiff, James Jindra, a patient of Ohio Marijuana Card and others like him are at risk of identity theft, fraud, and harassment due to the company's negligence in implementing reasonable security measures. Additionally, the lawsuit asserts that the company failed to notify patients, making it difficult for the members to take action to protect themselves.
The company's website notice said it has taken steps to secure its system, notified law enforcement and is reviewing its procedures to prevent future incidents. It is also offering anyone potentially impacted credit monitoring and identity protection services.
Other claims made by Jindra include that the defendant violated federal consumer protection and HIPAA laws, did not honor an implied agreement with patients to keep their information safe and saved money on cybersecurity costs at the expense of clients. The plaintiff also asked the court to require the company to fix its security flaws and protect patients going forward.
In the frequently asked questions section of the Ohio Marijuana Card website, the company includes information on patient privacy, noting that its file storage system is HIPAA-compliant.
“With regards to the Ohio Board of Pharmacy's Patient Registry system, only your recommending physician, dispensaries, and Ohio Board of Pharmacy will have access to this system — no information is allowed to be shared,” the company states.
See the complaint below.
jindra-v-ohio-medical-alliance-complaint-9-3-25DownloadHence then, the article about ohio marijuana card lawsuit nearly 1 million patient records accessed online was published today ( ) and is available on NBC4 ( Middle East ) The editorial team at PressBee has edited and verified it, and it may have been modified, fully republished, or quoted. You can read and follow the updates of this news or article from its original source.
Read More Details
Finally We wish PressBee provided you with enough information of ( Ohio Marijuana Card lawsuit: Nearly 1 million patient records accessed online )
Also on site :