Cannabis users’ sensitive data leaked in “serious” breach

Cannabis, Cyber Security, Cannabis users’ sensitive data leaked in “serious” breach

Internet privacy researchers at vpnMentor have discovered a data breach in point-of-sale software used in the cannabis industry

The team, led by Noam Rotem and Ran Locar, identified an unsecured data repository owned by THSuite, which contained sensitive data from numerous marijuana dispensaries across the United States.

Among the leaked data were names, addresses, government and employee IDs and further personally identifiable information.

THSuite offers software to cannabis dispensaries across the US. In order to comply with state laws, dispensaries have to collect a large amount of data from each individual transacting. 

The THSuite platform is used to manage all of this data, plugging into each state’s traceability system through an API, making the process quicker and easier.

Over 85,000 files were found to have been leaked in the data breach, 30,000 of which included sensitive, personally identifiable information. According to vpnMentor, the leak also included scanned government and company IDs. 

READ MORE: Millions of fingerprints leaked in latest high-profile data breach

In a blogpost detailing the report, vpnMentor said: “The leaked bucket contained so much data that it wasn’t possible for us to examine all the records individually.

“In the sample of entries we checked, we found information related to three marijuana dispensaries in different locations around the US.”

Amedicanna Dispensary, Bloom Medicinals and Colorado Grow Company were among the worst-hit companies, but the breach affected many more dispensaries. vpnMentor even goes so far as to say that it is possible for all THSuite clients and customers to have had their data leaked.

“As a result of this data breach, sensitive personal information was exposed for medical marijuana patients, and possibly for recreational marijuana users as well. This raises some serious privacy concerns.

“Medical patients have a legal right to keep their medical information private for good reason. Patients whose personal information was leaked may face negative consequences both personally and professionally.

Under HIPAA regulations, vpnMentor state that it is a federal crime in the US for a health service provider to expose personal information. Violations can result in fines of up to $50,000 for each leaked record.

There is still a stigma around cannabis use. Some workplaces even prohibit it entirely. vpnMentor fears that individuals using cannabis either recreationally or for medical purposes may face consequences at their place of work, or even at home.

vpnMentor has contacted THSuite. At the time of publication, they had not yet received a reply. 

Cannabis, Cyber Security, Cannabis users’ sensitive data leaked in “serious” breach

Ben Ashman

Ben is a multimedia journalist with a keen passion for technology, literature and art. When he isn't writing you can find him wandering around London's museums and galleries.

Personalization is the beating heart of successful hybrid cloud

Amber Donovan-Stevens • 27th November 2021

In the post-millennial era of real world cloud deployment, the modern digitally distributed nature of businesses requires a range of infrastructure options to allow each customer to leverage a mix of cloud technologies to best suit their unique needs while optimizing the associated costs. How can we enable this kind of flexibility in the face...

The Best Ten Rated Cloud Security Management Options For Business

Erin Laurenson • 24th November 2021

Cloud Security programs that can carry out safety procedures and address or flag potential high-risk elements are now critical, allowing businesses to function normally without fearing a potential breach. To help you find the best Cloud management and security system for your business, we’ve done the research and found the top systems presently available on...

How the cloud can drive organizational sustainability goals

Amber Donovan-Stevens • 24th October 2021

Mark Hughes, RVP of UK & Ireland, Epicor, explores cloud computing’s implications for organisational sustainability practices and introduces the key findings of Epicor’s survey of technology decision-makers in the US and the UK.xplains how cloud technology can spearhead an organizations sustainability initiatives.