Ohio Medical Alliance LLC exposed two unprotected, misconfigured databases containing 957,434 records of medical marijuana patients, including Social Security numbers (SSNs), driver’s license images, home addresses, dates of birth, and deeply sensitive medical files (e.g., PTSD evaluations, physician certifications, and intake forms). The 323 GB of exposed data also included a CSV file with 210,000+ email addresses (patients, employees, business partners) and internal staff comments. The databases lacked encryption or password protection, allowing unrestricted public access until cybersecurity researcher Jeremiah Fowler reported the exposure. The breach risks identity theft, financial fraud, healthcare record abuse, and discrimination—particularly severe given the federal illegality of marijuana and the sensitivity of mental health disclosures. The company restricted access after notification but provided no confirmation on whether the data was accessed by malicious actors or how long it remained exposed. Third-party involvement in data management remains unconfirmed.