STIIIZY data breach exposes cannabis buyers’ IDs and purchases

STIIIZY disclosed a data breach stemming from a compromise of its point-of-sale vendor between Oct 10–Nov 10, 2024 (vendor notified STIIIZY on Nov 20); attackers exfiltrated sensitive customer PII—government IDs (drivers' licenses, passport numbers, photos), medical cannabis cards, signatures, and transaction histories—and the Everest ransomware gang claimed the incident and posted sample data, while STIIIZY said the impact was limited to purchases at four specific store locations and will offer affected customers credit monitoring.