What happened in the Ohio Marijuana Card data breach?

A security researcher discovered an unprotected 323-GB database containing roughly 957,000 patient-related records. Access was later restricted, but the exposure duration remains unknown.

What data was compromised in the Ohio Marijuana Card incident?

Driver’s license images, names, addresses, dates of birth, Social Security numbers, medical diagnoses, physician certifications, and other sensitive intake documents.

Has Ohio Marijuana Card confirmed the breach?

As of August 20, 2025, the company has not publicly acknowledged or detailed the incident.

Am I automatically entitled to compensation?

Not automatically. You must demonstrate potential or actual harm and meet any legal claim requirements. Speaking with a qualified data-privacy attorney can clarify your eligibility.

What should I do if my Ohio Marijuana Card information was exposed?

Implement credit monitoring or a freeze, watch for suspicious account activity, safeguard sensitive documents, and consult legal counsel about joining a potential class action or individual claim.

Ohio Marijuana Card Data Breach Lawsuit Investigation

Was your personal information left wide-open online without your knowledge? A massive, 323-GB database tied to Ohio Marijuana Card reportedly exposed nearly one million highly sensitive records. Find out how to protect yourself and learn if you can file a claim below.

What Happened?

Cyber-security researchers uncovered an unencrypted and non-password-protected database containing 957,434 records believed to belong to Ohio Medical Alliance LLC, doing business as Ohio Marijuana Card. Within 24 hours of being alerted, public access to the database was removed, yet the company has not publicly confirmed the breach as of August 20, 2025.

What Information Was Exposed?

According to the researcher’s sample review, the database included:

High-resolution images of driver’s licenses and other IDs (names, addresses, dates of birth, license numbers)
Intake forms, release forms, and physician certifications—many listing complete Social Security numbers
Mental-health evaluations and medical records describing diagnoses and treatment reasons
Folders labeled with patient first and last names—suggesting highly organized, individual files

Notably, the records spanned multiple states, reflecting Ohio Marijuana Card’s clinic network across Ohio, Arkansas, Kentucky, Louisiana, Virginia, and West Virginia.

Why This Breach Matters

Medical information is among the most sensitive data a person can lose. Combined with full identity details, the exposed files offer a treasure trove for identity thieves who can:

Open fraudulent credit lines or loans
File false tax returns or unemployment claims
Exploit medical information for blackmail or privacy violations
Create forged driver’s licenses and other identity documents

Additionally, the stigma surrounding medical cannabis use means victims could face reputational harm if their records become public.

What Ohio Marijuana Card Patients Should Do Now

Immediate Steps to Protect Your Identity

Place a fraud alert with the three major credit bureaus.
Consider a credit freeze if you suspect misuse.
Review your credit reports for unfamiliar accounts.
Monitor Explanation of Benefits (EOBs) from insurers for strange charges.
Change passwords and enable multi-factor authentication on email and financial accounts.

Explore Your Legal Options

If Ohio Marijuana Card failed to adequately safeguard patient data, victims could be entitled to compensation for out-of-pocket losses, emotional distress, and future monitoring costs. Time limits apply, so it’s critical to act swiftly.

FAQ: Ohio Marijuana Card Data Breach

What happened in the Ohio Marijuana Card data breach?: A security researcher discovered an unprotected 323-GB database containing roughly 957,000 patient-related records. Access was later restricted, but the exposure duration remains unknown.
What data was compromised in the Ohio Marijuana Card incident?: Driver’s license images, names, addresses, dates of birth, Social Security numbers, medical diagnoses, physician certifications, and other sensitive intake documents.
Has Ohio Marijuana Card confirmed the breach?: As of August 20, 2025, the company has not publicly acknowledged or detailed the incident.
Am I automatically entitled to compensation?: Not automatically. You must demonstrate potential or actual harm and meet any legal claim requirements. Speaking with a qualified data-privacy attorney can clarify your eligibility.
What should I do if my Ohio Marijuana Card information was exposed?: Implement credit monitoring or a freeze, watch for suspicious account activity, safeguard sensitive documents, and consult legal counsel about joining a potential class action or individual claim.

Stay Informed & Protect Your Rights

Data-privacy laws give you the right to seek relief when companies fail to secure your personal information. Stay alert for any mailed notice from Ohio Marijuana Card and document unusual account activity. If you believe you are affected, request a free case evaluation to discuss next steps.