Stiiizy data breach: what happened and what to do

Stiiizy is a California cannabis brand with its own dispensaries. In January 2025 it notified customers that a third-party point-of-sale vendor had been breached, and that personal information the vendor processed for Stiiizy was taken.

What happened

Per the notice, an unauthorized party took the information on or around October 10, 2024, and access continued into November. The vendor told Stiiizy about the compromise on November 20, 2024, and Stiiizy began mailing notices in early January 2025. The California Attorney General's breach list carries the filing, with a breach date of October 10, 2024.

Stiiizy's filing with the Maine Attorney General counts at least 380,000 people. Other estimates run higher, so treat 380,000 as the floor. A ransomware group called Everest claimed the attack. Stiiizy hasn't verified that claim.

What was exposed

The data varies from person to person. According to the notice, it can include:

• Names, addresses and dates of birth
• Driver's license and passport numbers
• Photographs and signatures on government IDs
• Medical cannabis cards
• Transaction histories

This is the kind of data that matters most, because an ID photo and a date of birth together are what criminals need to open accounts in someone's name or pass an identity check. A purchase history is also personal in its own right, and it gives a scammer a believable hook for a phone call or text that mentions Stiiizy.

What criminals can do with it

Expect phishing and smishing that uses your name and your link to the brand. Scans of IDs are the bigger long-term risk: they can be used for synthetic or new-account fraud, and you can't change your date of birth the way you change a password. Nothing in the notice says passwords or payment card numbers were involved.

The company's response

Stiiizy offered 12 months of free credit monitoring through Cyberscout, a TransUnion company, with an enrollment deadline of April 7, 2025. The deadline has passed, so if you got a letter and never enrolled, contact the company through the number in your letter to ask what's still available. The notice also advises customers to watch their financial accounts and consider a fraud alert on their credit files.

Letters list which data types applied to you. If you got one, that list is the most reliable answer to what was exposed in your case.

If an ID was in the data

Most breaches leak things you can change. This one can include a driver's license number and a photo of the license, and those stay valid for years. A few practical points follow from that. Lenders and phone carriers sometimes accept an ID photo plus a date of birth for a new account, so a credit freeze matters more here than a password change. If you use your license number as a login or recovery detail anywhere, switch to something else. And if someone does open an account in your name, file a report at IdentityTheft.gov, which gives you a recovery plan and a record to show lenders.

Cannabis purchases are legal in California, but plenty of people still keep them private. A leaked purchase history can embarrass or be used to pressure someone, so be especially cautious about messages that mention it and don't reply to any that demand payment.