The personal information of over 11,700 medical cannabis dispensary applicants in Nevada has been leaked via the state’s medical cannabis website portal, according to a ZDnet report. The vulnerability was discovered by security researcher Justin Shafer using a unique Google search query. The site in question has been pulled until the bug is fixed and the query was not published by ZDnet.
The information leaked includes application details, including a person’s full name and home address, citizenship status, driver license and social security numbers, phone numbers, birth date, race, height, weight, and hair and eye color.
A Nevada Department for Health and Human Services spokesperson and a representative for a Las Vegas dispensary confirmed that the information discovered was legitimate and accurate. The Health and Human Services Department — who runs the medical cannabis application program — indicated that the data was a “portion” of one of several databases, the report said.
In accordance with state law, applicants will be notified of the leak officially within a few days. It is not clear how many years the applications date back. Nevada legalized medicinal cannabis use during the 2000 elections and voters approved a ballot initiative legalizing adult-use during this year’s General Election.