Yeah it's either that or they got it through the portal by guessing their health insurance number which is made up of your first and last names with date of bir

Yeah it's either that or they got it through the portal by guessing their health insurance number which is made up of your first and last names with date of birth and finally two numbers that serve as a way to handle people with the same name born on the same day. For example, John Doe born in 2001-01-01 with have the health insurance code DOEJ010101XX where XX is how many people with the DoEJ were born that day. So usually you need 0-10 guesses to get it. Just did the process and it also asks for your mother's maiden name and when and where you got your first dose so it's not like this can allow attackers to leak everyone's info and while I didn't try it myself I am fairly sure that the requests are rate limited. Finally the info in the QR code itself is just Name + Date of Birth + when and where you got your two doses so it's not like it actually means anything.