Full Report
A data breach in November exposed the IDs and passports of people who bought products from STIIIZY, a large marijuana dispensary in California.
Analysis Summary
# Incident Report: STIIIZY Customer Data Breach by Everest Gang
## Executive Summary
STIIIZY, a major California-based cannabis retailer, suffered a data breach impacting customer personal information, including IDs and passports, after a vendor's point-of-sale (POS) systems were compromised. The attack, attributed to the Everest cybercrime group, led to the exfiltration of over 422,000 customer records between October 10 and November 10, 2024. STIIIZY is offering credit monitoring services to affected customers following the discovery of the breach in late November.
## Incident Details
- Discovery Date: November 20, 2024 (Notified by POS vendor)
- Incident Date: Ongoing activity observed between October 10, 2024 - November 10, 2024
- Affected Organization: STIIIZY (California dispensary)
- Sector: Retail (Cannabis)
- Geography: California (San Francisco, Alameda, Modesto mentioned)
## Timeline of Events
### Initial Access
- Date/Time: On or around October 10, 2024
- Vector: Compromise of a point-of-sale processing services vendor serving STIIIZY retail locations.
- Details: The intrusion appears to have targeted the vendor, which subsequently provided access to STIIIZY customer data. The Everest group typically leverages weak credentials, unpatched vulnerabilities, and phishing.
### Lateral Movement
- Details: The group is known to "move laterally within networks" after gaining initial access. Specific internal movements at STIIIZY are not detailed, but compromise extended across multiple retail locations processed by the vendor.
### Data Exfiltration/Impact
- Date/Time: Activity concluded by November 10, 2024
- Details: Personal information of certain customers processed by the vendor was acquired by threat actors. The stolen data included driver's license numbers, passport numbers, photographs, medical cannabis cards, names, ages, addresses, and transaction histories. Everest claimed to have stolen 422,075 personal records.
### Detection & Response
- Date/Time: November 20, 2024
- Details: Detected when the POS vendor notified STIIIZY of the compromise. An internal investigation confirmed the data leak. The company publicly disclosed the breach and filed notices with California regulators. The threat actors set a ransom deadline of December 8, 2024.
## Attack Methodology
- Initial Access: Compromise of a third-party Point-of-Sale (POS) processing vendor.
- Persistence: Not explicitly detailed, but typically part of the ransomware/extortion playbook.
- Privilege Escalation: Not specified, but common tactics include exploiting unpatched vulnerabilities.
- Defense Evasion: The threat actor (Everest) is skilled at avoiding detection by using encrypted communication channels and secure methods (as per expert analysis).
- Credential Access: Likely exploited weak credentials targeting vendor access.
- Discovery: Standard reconnaissance within the vendor's/STIIIZY's environment to locate valuable customer records.
- Lateral Movement: Techniques used to traverse the network environment once initial access via the vendor was achieved.
- Collection: Gathering sensitive biographical data, IDs, photographs, and transaction details.
- Exfiltration: Data theft occurred between October 10 and November 10, 2024.
- Impact: Extortion attempt (ransom deadline set) and public disclosure of sensitive customer PII/PHI.
## Impact Assessment
- Financial: Undisclosed ransom demand may have been negotiated or paid; costs associated with investigation and offering credit monitoring.
- Data Breach: Over 422,000 records exposed, including highly sensitive financial/identity documents (Driver's License numbers, Passport numbers, Photos, Medical Cannabis Cards).
- Operational: Potential disruption within retail operations related to POS systems during the investigation phase.
- Reputational: Public disclosure of a significant breach involving identity documents for a visible consumer brand.
## Indicators of Compromise
- Network Indicators: None provided (URLs/IPs defanged).
- File Indicators: None provided.
- Behavioral Indicators: Anomalous data access and large-scale data transfer originating from POS processing environments; extortion communications from Everest gang.
## Response Actions
- Containment Measures: Immediate action taken upon notification by the vendor to secure affected POS systems and environments.
- Eradication Steps: Likely involved isolating compromised vendor components, reviewing access controls, and potentially resetting credentials related to the POS service.
- Recovery Actions: Offering free credit monitoring services to affected customers.
## Lessons Learned
- Vendor Risk Management is critical; the breach originated through a third-party POS vendor, emphasizing the need for rigorous security auditing of service providers handling sensitive data.
- Reliance on POS systems for storing or processing highly sensitive PII (like passport numbers and photographs) creates significant liability exposure.
- The threat actor (Everest) specialized in extortion rather than encryption, requiring a different approach to negotiation or response than traditional ransomware.
## Recommendations
- Immediately review and segment third-party POS vendor environments, ensuring the principle of least privilege is strictly enforced.
- Implement mandatory, multi-factor authentication (MFA) for all vendor access points, actively monitoring for weak credentials used by attackers.
- Encrypt all highly sensitive PII (passports, IDs) both in transit and at rest, moving away from storing images or government IDs unless absolutely required under regulation.
- Enhance network monitoring specifically for data exfiltration paths, focusing on traffic patterns unusual for POS processing environments.