Stiiizy
Disclosed Dec 20, 20241 year agoConfirmed
Point-of-sale vendor hack exposes cannabis buyers' ID documents
Stiiizy said an organized cybercrime group compromised its point-of-sale vendor and took customer data processed between October 10 and November 10, 2024 at four California stores, including driver's licenses, passports and medical cannabis cards.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Dec 20, 2024 |
| Discovered | Nov 20, 2024 |
| Happened | Oct 10, 2024 |
| Attack | Vendor breach |
| Data exposed | Names, Addresses, Dates of birth, Government IDs, Health, Financial |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Stiiizyoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Stiiizyatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Stiiizyjustice.oregon.gov · Official notice | Official notice |
| Cannabis company Stiiizy says hackers accessed customers' ID documentstechcrunch.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | Dec 20, 2024 | 3,500 |
| Oregon DOJresidents of OR | Dec 31, 2024 | 380,000 |
| California AGresidents of CA | Jan 8, 2025 | |
| Researchtotal | Jan 10, 2025 | |
| Oregon DOJresidents of OR | Jan 28, 2025 | 380,000 |
History of this record
- 2026-09-25 · sector: other to retail · seed source
- 2026-09-25 · attack: hacking to third-party · seed source
- 2026-09-25 · data_types: [] to ["names","addresses","dob","government-id","health","financial"] · seed source
- 2026-09-25 · summary: empty to Stiiizy said an organized cybercrime group compromised its point-of-sale vendor and took customer data processed between October 10 and November 10, 2024 at four California stores, including driver's licenses, passports and medical cannabis · seed source
- 2026-09-25 · title: empty to Point-of-sale vendor hack exposes cannabis buyers' ID documents · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · disclosed: 2025-01-08 to 2024-12-20 · backfill source
- 2026-09-25 · discovered: empty to 2024-11-20 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.