Stiiizy

Disclosed Dec 20, 2024Confirmed

Point-of-sale vendor hack exposes cannabis buyers' ID documents

Stiiizy said an organized cybercrime group compromised its point-of-sale vendor and took customer data processed between October 10 and November 10, 2024 at four California stores, including driver's licenses, passports and medical cannabis cards.

What is known

People affected	Not stated in the sources we have
Disclosed	Dec 20, 2024
Discovered	Nov 20, 2024
Happened	Oct 10, 2024
Attack	Vendor breach
Data exposed	NamesAddressesDates of birthGovernment IDsHealthFinancial
Sector	Retail · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Stiiizy

Official noticeatg.wa.gov

Washington Attorney General breach notice: Stiiizy

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Stiiizy

Newstechcrunch.com

Cannabis company Stiiizy says hackers accessed customers' ID documents

Notices filed

Residents of WADec 20, 2024

Washington AG3,500 people

Residents of ORDec 31, 2024

Oregon DOJ380,000 people

Residents of CAJan 8, 2025

California AGCount not stated

TotalJan 10, 2025

ResearchCount not stated

Residents of ORJan 28, 2025

Oregon DOJ380,000 people

History of this record

sector2026-09-25

other to retailby seedSource

attack2026-09-25

hacking to third-partyby seedSource

data_types2026-09-25

[] to ["names","addresses","dob","government-id","health","financial"]by seedSource

summary2026-09-25

empty to Stiiizy said an organized cybercrime group compromised its point-of-sale vendor and took customer data processed between October 10 and November 10, 2024 at four California stores, including driver's licenses, passports and medical cannabisby seedSource

title2026-09-25

empty to Point-of-sale vendor hack exposes cannabis buyers' ID documentsby seedSource

attack2026-09-25

unknown to hackingby backfillSource

disclosed2026-09-25

2025-01-08 to 2024-12-20by backfillSource

discovered2026-09-25

empty to 2024-11-20by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Stiiizy