- Cannabis shop Stiizy in Los Angeles files a new report with the California Attorney General
- The report discusses a November 2024 cyber incident that researchers say was a ransomware attack
- Thousands of customers may be affected by the breach
Stiiizy, a popular Los Angeles-based cannabis company, confirmed that in late 2024 it suffered a cyber attack in which it lost a lot of sensitive customer information.
In a new filing with the California Office of Attorney General, the company provided a breach letter that was sent out to affected customers. It said a point-of-sale service provider for some of its retail locations notified it that some of their accounts had been compromised by an “organized cybercrime group.”
The cannabis dealer did not discuss the attackers, their identities or their motives. But citing cybersecurity researchers, TechCrunch reported that a ransomware operator called Everest was behind this attack.
Names and photos
Stiiizy didn’t say how many people were affected by the incident, but it did say what data was taken: full names, mailing addresses, dates of birth, age, driver’s license numbers, passport numbers, photos, signatures (as seen on government ID cards), medical cannabis card, transaction history and more. That’s enough information for personal phishing attacks, identity theft, and more.
The notification was sent on November 20th and a subsequent investigation revealed that the breach occurred on October 10th and most likely lasted until November 10th. in Modesto.
Everest has reportedly claimed responsibility for this attack, stating that more than 420,000 customers were affected — though it’s perhaps worth mentioning that the number “420” is often mentioned in connection with marijuana: April 20 is also an unofficial marijuana holiday . Everest also added that it decided to leak the data after Stiiizy decided not to pay the ransom demands.
As of May 2024, Stiiizy operated 34 retail stores in California and three in Michigan, and its products are available in several US states, including California, Washington, Nevada, Michigan, Illinois, and Arizona.
Via TechCrunch
