Nevada’s medical marijuana application system leaked the personal information of nearly 12,000 registry applicants. The state shut down the medical marijuana portal on Dec. 8 after a “problem” was identified and opened an investigation into the issue, a state spokeswoman said last week.
Those vulnerabilities were corrected and the division was “given the go ahead” to restore the online portal on December 15th 2016.
Then after becoming aware of the most recent data breach, the state has just closed the medical cannabis establishment portal for the second time this month. The portal houses those documents, as well as medical cannabis cardholder information.
“The entire portal has been taken down,” Division of Public and Behavioral Health Administrator Cody Phinney said in a news release Wednesday afternoon.
A spokesperson for the Nevada Dept. Health and Human Services, which runs the medical cannabis application program, told technology news site ZDNet that the website was pulled offline to limit the vulnerability. Each eight-page application calls for the person’s social security number, driver’s license number and full address in addition to details like height, weight and eye color.
A glitch in the state’s medical cannabis program portal on Nevada’s government website made all that information on the thousands of applications accessible to the entire internet. Security researcher Justin Shafer first discovered the site’s vulnerability — which allows anyone with either a legitimate application or the correct web address access to the revealing PDFs — after a simple Google search.
The spokesperson for the Nevada Dept. Health and Human Services added that the leaked data was a “portion” of one of several databases.
The state’s medical cannabis program website portal reports the following:
ONLINE PATIENT REGISTRY TEMPORARILY DOWN
Our apologies, the online patient registry is temporarily down. It will be restored as soon as possible. While the online patient registry is down, renewal applications can be requested by the means listed below:
1. Email a request to: firstname.lastname@example.org
2. Fax a request to: 775-684-3213
3. Mail a request to: 4150 Technology Way, suite 101, Carson City, NV 89706
Nevada legalized medical cannabis in 2000 with uses limited to cancer patients and those with HIV and AIDS as well as other chronic conditions. In the most recent election, the Silver State joined the likes of California, Massachusetts and Maine in legalizing marijuana for recreational purposes.