Listen to this post

On September 23, 2026, a Planet 13 cannabis dispensary customer filed a proposed class action in the U.S. District Court for the District of Nevada against Planet 13 and its identity-verification vendor, IDScan.net, Inc. The suit, first reported by Law360’s Sam Reisman, alleges that Planet 13 scanned thousands of customers’ government-issued photo IDs at its Las Vegas SuperStore, and that the images were later found for sale on the dark web.

The Planet 13 suit is the latest reminder that cannabis companies sit on a mountain of sensitive personal data, government IDs, medical cannabis cards, and purchase histories that they are required by law to collect but not always equipped to protect. This post looks at what the lawsuit alleges, places it alongside earlier cannabis-sector data breaches, and outlines practical steps cannabis companies can take now to shore up their data security practices and limit their own exposure.

The Allegations

The complaint against Planet 13 asserts that while Nevada law requires cannabis retailers to verify a customer’s age using an approved identification scanner, it does not require retailers to photograph, retain, or otherwise monetize the identification document once age has been confirmed. The plaintiff attempts to turn that latter, extra security step of Planet 13 into a fault and the cause of the ultimate alleged data breach.

Specifically, the complaint alleges that Planet 13, working with its vendor IDScan.net, photographed every ID under white, ultraviolet, and infrared light at each of its 16 Las Vegas check-in stations, synced those images to IDScan’s centralized cloud platform (VeriScan Online Enterprise), and used the parsed data to build customer profiles for marketing and operational purposes.

Tying this practice to a broader breach, the complaint alleges that a security research report revealed that a dark web marketplace was offering digital scans of more than 153 million U.S. and Canadian driver’s licenses, along with millions of other identification and travel documents, and that the operators claimed to have been exfiltrating data for over a year. The complaint alleges that the image formats matched those produced by Planet 13’s scanners, and that IDScan.net published a notice on September 4, 2026, acknowledging that customer data stored in its cloud may have been accessed without authorization. The FBI has reportedly opened an investigation into the vendor.

Named plaintiff Aleksander Djordjevic alleges he presented his ID at a Planet 13 check-in station in December 2025 despite having no rewards account or other ongoing relationship with the company, underscoring the complaint’s core theory: that the data was collected as a condition of entry, not as part of a voluntary customer relationship, and retained far beyond what compliance required. The complaint asserts claims for negligence, breach of implied contract, breach of third-party beneficiary contract, unjust enrichment, and violation of Nevada’s consumer fraud statute, and seeks damages, restitution, and injunctive relief compelling the defendants to secure and delete the identification documents collected.

Distinguishing cannabis-sector breaches from many others, the complaint also emphasizes that because cannabis remains illegal under federal law, a record placing a named, photographed individual at a dispensary on a specific date can carry consequences for employment, professional licensing, immigration status, firearms eligibility, and child custody that a stolen credit card number simply does not.

The complaint seeks certification of a nationwide class of all persons in the United States who presented a government-issued identification document at a Planet 13 dispensary that was scanned using IDScan.net technology during the class period, plus a Nevada subclass limited to those who presented their ID at a Nevada Planet 13 location. That class could comprise “hundreds of thousands of individuals,” pointing to Planet 13’s own disclosures that its Las Vegas SuperStore alone can serve 3,000 to 5,000 customers per day and that the company maintains a customer-loyalty database of over 485,000 customers.

Not the First of Its Kind

The Planet 13 suit is the latest in a pattern of data breach litigation targeting the cannabis industry and the vendors that serve it, reflecting the sensitive, government ID-heavy data that dispensaries are required to collect for compliance purposes.

In January 2025, cannabis retailer STIIIZY, Inc. disclosed that a point-of-sale vendor serving several of its California locations had been compromised by a cybercrime group, exposing customers’ names, addresses, dates of birth, driver’s license and passport numbers, photographs, signatures on government IDs, medical cannabis cards, and transaction histories. Within days, multiple proposed class actions were filed in the Central District of California, alleging negligence and violations of California’s medical information, consumer privacy, and consumer protection statutes, among other theories. Those cases were consolidated, and the parties have since reached a proposed class settlement establishing a multimillion-dollar settlement fund, reimbursement for documented losses, and credit monitoring and identity theft insurance for the class, along with commitments by STIIIZY to make substantial improvements to its IT infrastructure, cybersecurity, and privacy policies and procedures.

Cannabis-industry software vendors have faced similar exposure. Security researchers previously discovered that THSuite, a point-of-sale and compliance platform used by dispensaries across the country, had left an Amazon S3 storage bucket unsecured, exposing scanned government and employee IDs and other personally identifiable information for tens of thousands of individuals tied to multiple dispensaries. That incident illustrated how a single vendor’s lax security practices can cascade into exposure for every dispensary client relying on that vendor’s compliance infrastructure, and for those dispensaries’ customers and patients.

Taken together, the Planet 13, STIIIZY, and THSuite matters highlight the conundrum of how state law requires cannabis retailers to collect and verify government-issued identification, that retailers and their technology vendors retain and often aggregate far more of that data than compliance strictly requires, and when a breach occurs, the exposed data set is unusually sensitive because it links a real name and photograph to participation in an activity that remains federally illegal.

Why This Matters for Cannabis Companies

Cannabis retailers occupy an unusually exposed position in the data security landscape. They are legally required to collect sensitive identity documents at the point of sale, they often rely on third-party vendors to scan, store, and process that data, and a breach touching that data carries consequences for customers that go beyond the financial harm typically associated with a stolen payment card number. At the same time, the industry continues to operate in a patchwork regulatory environment without the benefit of federal guidance comparable to HIPAA for healthcare data, even though state medical cannabis programs often involve data just as sensitive as protected health information. As with the healthcare sector, where hacking-related breaches rose sharply and affected more than 134 million individuals in 2023 alone, the trend in cannabis data breach litigation suggests exposure will continue to grow as retailers and their vendors accumulate larger stores of sensitive customer data.

Precautionary Steps Cannabis Companies Should Consider

Cannabis companies and their vendors that collect, process, or store government identification, medical cannabis card data, or other personal information should take proactive steps now, before a breach occurs, to reduce both the likelihood of an incident and the company’s exposure if one happens.

Secure Adequate Cyber Liability and Data Breach Insurance

  • A comprehensive, stand-alone cyber insurance policy, rather than reliance on incidental cyber endorsements to a general liability or property policy, is generally the better approach, since piecemeal coverage often proves inadequate when an actual incident occurs.
  • Companies should review their coverage for gaps between first-party costs (forensic investigation, system restoration, business interruption) and third-party costs (customer notification, regulatory defense, third-party liability), since a policy that covers the cost of investigating a breach will not necessarily cover the cost of notifying affected individuals or defending consumer class actions.
  • Because the federal legality of cannabis is still not fully adjudicated, companies should confirm with brokers and coverage counsel that carriers will not attempt to deny coverage on public-policy grounds tied to the plant touching or cannabis-adjacent nature of the business, and should understand exactly how their policy defines a covered “security incident” or “cyber extortion” event.
  • When an incident occurs, companies should notify their carrier immediately, since most policies require notice “as soon as practicable” and late notice can jeopardize coverage entirely.

Implement Adequate Policies and Procedures

  • Companies should adopt a written incident response plan that identifies roles, escalation paths, and notification timelines before an incident occurs, rather than improvising a response under pressure.
  • Data retention practices deserve particular attention in this sector. As the Planet 13 complaint illustrates, collecting only the information that compliance actually requires and configuring vendor platforms to purge identification images and personal data promptly after verification rather than defaulting to indefinite retention meaningfully limits the scope of any future breach.
  • Companies should implement multi-factor authentication, encryption of data at rest and in transit, regular security audits, and routine staff training, consistent with the baseline practices regulators have identified as most effective at preventing or limiting the impact of common attack methods such as phishing and credential compromise.
  • Vendor contracts should include specific data security, retention, and breach notification obligations, since a company’s own security posture is only as strong as that of every third-party vendor with access to its customers’ data, as both the Planet 13/IDScan.net and STIIIZY point-of-sale vendor incidents demonstrate.
  • Companies should also prepare a communications and regulatory notification protocol in advance, since delayed or absent breach notification, as alleged against both Planet 13 and IDScan.net, can itself become an independent basis for liability and reputational harm.

Retain Qualified Professionals to Evaluate Risk Management Tools

  • Periodic risk assessments conducted by qualified cybersecurity professionals, particularly when adopting new technology or expanding operations, can identify vulnerabilities before they are exploited.
  • Coverage counsel should review cyber insurance policy terms and conditions before binding coverage and again upon renewal, to identify gaps and to confirm that policy limits and sublimits are commensurate with the volume and sensitivity of data the company handles.
  • Outside privacy and data security counsel should be engaged to evaluate compliance with applicable state consumer privacy, data breach notification, and medical information statutes, which vary significantly by state and often create private rights of action that increase litigation exposure.
  • Companies should conduct thorough due diligence on third-party technology vendors before engagement and should maintain ongoing monitoring of those vendors’ security practices rather than treating vendor selection as a one-time compliance checkbox.

Looking Ahead

The Planet 13 litigation is a reminder that cannabis companies sit between these two high-risk data security categories: businesses (1) required by state law to collect sensitive government identification, and (2) operating in a legal gray area where the exposure of that data carries consequences beyond ordinary identity theft. As data breach litigation against dispensaries and their technology vendors continues to mount, cannabis companies that have not yet audited their data collection, retention, and vendor management practices, and confirmed the adequacy of their cyber insurance coverage should treat this litigation as a call to action rather than a cautionary tale about someone else’s business. “When life looks like easy street, there is danger at your door” is a fitting warning from Hunter and Garcia for an industry whose growth could have outpaced its data security safeguards.