HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedTargetedIdentity (basic)Government IDPIIMediumContained

Stiiizy Inc

bd_798a4ba279e86965 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 20, 2024

Filed

Jan 8, 2025

To disclose

7 weeks

Affected

318state residents only

Linked

10 filings

Confidence

64%

Full breach record for Stiiizy Inc →

Stiiizy, Inc. notified Montana AG of a data breach involving a third-party POS vendor. Threat actors compromised vendor accounts, acquiring customer PII (names, addresses, government IDs) from four California dispensaries between Oct 10 and Nov 10, 2024. Stiiizy discovered the incident on Nov 20, 2024, and sent notifications on Jan 8, 2025. Free credit monitoring is offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 41 days

discovery → filing · 7 weeks / 49 days

Oct 10, 2024

Begins

Nov 20, 2024

Discovered

Jan 8, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteeverestbd_3d72d8f2b6dda7782024-11-24 · +44dVerified by operator

Regulatory filings (8) · sorted by filing gap

Nebraska State AGbd_557f472be0e22b0c2025-01-08Verified
California State AGbd_99313b432eacb90b2025-01-08Verified
Maine State AGbd_3408bc4c56c5ec172025-01-09 · +1dVerified
Massachusetts State AGbd_c87296d4ac4525e12025-01-09 · +1dVerified

Show 4 more filings ↓up to 20d gap

Illinois State AGbd_9edc660b072a82662025-01-01 · +7dVerified
Oregon State AGbd_ddcff6b1f50a788f2024-12-31 · +8dVerified by operator
Washington State AGbd_949f0ceb6ea5db5a2024-12-20 · +19dCandidate
Oregon State AGbd_e4deed8b915421cd2025-01-28 · +20dVerified by operator

Name: Stiiizy Inc
norm: stiiizy
Domain: stiiizy.com

Name: Stiiizy Inc
norm: stiiizy
Domain: stiiizy.com
Industry: Retail & Consumerllm

Discovered: Nov 20, 2024
Breach occurred: Oct 10, 2024 – Nov 10, 2024
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 8, 2025
Affected individuals: 318state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Launched own investigation to assess the extent of the impact
Working closely with the vendor and legal counsel to address the situation
Implemented additional security measures designed to prevent a recurrence
Providing affected individuals with free credit monitoring services
Changes made: Implemented additional security measures designed to prevent a recurrence of such an attack
Providing affected individuals with free credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Washington State AGDec 20 · first

Oregon State AG+11d

Illinois State AG+12d

Nebraska State AG+19d

California State AG+19d

Montana State AG+19d · this page

Maine State AG+20d

Massachusetts State AG+20d

Oregon State AG+39d

Pattern: first filing Dec 20 (WA), last Jan 28 (OR) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/03/Consumer-notification-letter-154.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 8, 2025
Raw hash: 08600b4e74b013b6d0399372a8e67b2f33ad47e8283cfafd97f9e3390950db26

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityStiiizy Inc

Victim entityStiiizy Inc

Incidentdiscovered Nov 20, 2024

Stated responseLaunched own investigation to assess the extent of the impact

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov