Cannabis brand STIIIZY will pay $2.95 million to settle a class action lawsuit tied to an October 2024 data breach that exposed customers' personal and health information. The company disclosed the incident on January 7, 2025, and plaintiffs argued its security measures were simply not up to the job of protecting sensitive data.
What the breach covered and who qualifies
The class covers anyone whose personally identifiable information or private health records were accessed, compromised, or stolen in that incident. California residents get a separate subclass designation, and it comes with a financial edge: they receive twice the pro-rata cash payment compared to class members in other states.
For those with documented out-of-pocket losses, the ceiling is $7,500 per person. Everyone in the class, regardless of documented harm, can also claim free credit monitoring as part of the deal. Claims must be submitted through the settlement portal by September 10th. The opt-out and objection deadline falls earlier, on August 26th, and a final approval hearing is scheduled for October 19th.
STIIIZY's position and the road to settlement
The company denies any wrongdoing. That's standard language in these resolutions, but it doesn't change the price tag: nearly $3 million out the door to make the litigation go away. The original lawsuit alleged that STIIIZY kept inadequate safeguards in place, leaving the door open for unauthorized access to data that, in a cannabis retail context, can include especially sensitive health-related records.
Pro-rata payments mean the per-person cash amount will depend on how many valid claims get filed before the September deadline. The more claimants who participate, the smaller each individual slice of the $2.95 million pool becomes.
