Internet watchdog website: Ohio medical marijuana patients’ information may have been exposed in data breach

File Photo (Pixabay)
Published:

COLUMBUS (WBNS) - An internet watchdog claims that the private information of Ohio medical marijuana patients may have been exposed through a data breach.

In a report published on Wednesday, the website Vpnmentor says its researchers discovered that the private information – including names, dates of birth, email and street addresses – of Ohio medical marijuana patients may have been exposed.

Some of those whose data might have been who made purchases at Bloom Medicinals, a dispensary that has locations in Columbus, Maumee, Akron and the Cleveland and Cincinnati metro areas.

Advertisement - Story continues below

A woman who answered the phone at a Bloom Medicinals location in Columbus provided 10TV News with the following statement:

“Bloom Medicinals has been aware that its technology vendor experienced a data breach that may have affected some of our patients’ data.

We are working closely with our tech vendor to identify which, if any, patients have been affected.

Once we have identified any affected patients we will notify each patient and follow a HIPPA breach notification requirements.”

Researchers at VPNMentor said they were also able to see if patients had signed up for text messages or received financial assistance for their medical marijuana purchases.

The website also posted redacted screengrabs showing the dispensary’s monthly sales, discounts, returns and taxes paid.

According to VPNMentor, over 85,000 files were leaked in this data breach that affected THSuite, a point-of-sale system used by the cannabis industry. The research team said it identified an unsecured Amazon S3 bucket owned by THSuite that contained sensitive data from multiple marijuana dispensaries in the U.S.

A message was left for someone at Bloom Medicinals corporate office Thursday morning.

10TV News has also reached out to the Ohio Board of Pharmacy for comment.

According to the state’s medical marijuana website, there are currently more than 78,000 registered patients in Ohio. More than 55,000 have purchased medical marijuana since the program went online in early 2019.