Read cannabis breach coverage and you’d think the industry is being hit by five different kinds of adversary. A misconfigured storage bucket spilling identity documents across Europe. Ransomware freezing a US multi-state operator’s tracking integration. A compliance-software vendor’s API handing out records to anyone who asked. A point-of-sale compromise that ended in hundreds of thousands of notification letters. A dispensary’s customer list on a criminal forum.

Different headlines, same five mistakes. We’ve catalogued the individual incidents — the ten biggest cannabis breaches and the Ohio-to-California breach timeline — and the point of this piece is different. Forget who was breached. Look at what failed, and the industry’s entire loss history collapses into five patterns.

Every one of them is unglamorous. Every one of them has a fix an operator can implement this quarter.

Pattern 1: Identity Documents Kept After Verification

The largest cannabis data exposure of the year wasn’t a hack in any meaningful sense. Nearly a million passport and government-ID scans — belonging to cannabis club members across Europe and beyond — sat on the public internet with no password and no access control, discovered by researchers who simply found the URLs. That’s the CannaLeaks/PuffPal incident, and its root cause is a single design decision: the platform stored the ID image after using it.

This pattern is the industry’s signature failure. It repeats because the compliance instinct — keep proof you checked — quietly converts every age or membership verification into a permanent identity-document archive. Regulators asked operators to verify. Operators built vaults of passports.

The fix: separate verification from storage. Keep the result (verified, over 21, jurisdiction, timestamp, method), destroy the artifact. That’s the whole argument in verify, don’t store, and it’s why the same failure keeps showing up in age-gating regimes like North Carolina’s July hemp ID mandate. ID images you never kept cannot leak, cannot be ransomed, and cannot be classified as anything at all — which matters because what a cannabis record legally is changes at every border.

Pattern 2: The Vendor Was the Breach

Cannabis operators run on a small number of shared platforms: seed-to-sale tracking, POS, delivery dispatch, loyalty, e-commerce menus. That concentration means a single vendor failure becomes an industry-wide incident. The THSuite exposure years ago put tens of thousands of consumers’ records into the open through a vendor-side misconfiguration, and the pattern has never stopped — because the economics haven’t changed. One vendor, thousands of operators, one misconfigured datastore.

What makes this pattern worse in cannabis than in general retail is that the vendors sit on the license-critical path. A compromised tracking integration is not an IT outage; it’s chain-of-custody data integrity, which is the invisible attack surface of METRC, BioTrack, and seed-to-sale platforms.

The fix: vendor diligence with contractual teeth — breach notification windows in hours, not “promptly”; deletion on termination; the right to your own data export; evidence of encryption and access control rather than assertions. How to vet cannabis tech vendors before they get you breached is the process, and the POS vendor security assessment checklist is the artifact to hand them.

Pattern 3: A Phished Credential With No Second Factor Worth the Name

Ransomware in this industry rarely arrives via an exotic exploit. It arrives as a valid login. Cannabis retail concentrates every condition attackers want: high turnover, seasonal hiring, shared back-office accounts, and a compliance stack whose alert emails make perfect phishing bait — a fake “METRC password expiring” notice gets clicked because the real ones exist. The mechanics are in the ransomware pattern behind seed-to-sale incidents and why cannabis is a ransomware target in 2026.

The aggravating detail is that many operators believe they solved this. They deployed SMS codes or push approvals — both of which modern phishing kits relay in real time by proxying the genuine login page. Adding AI-generated pretexting, covered in AI-powered phishing is coming for your dispensary, removes the last tell: bad grammar.

The fix: phishing-resistant MFA on the accounts that matter — seed-to-sale, email, POS back office, banking — because origin-bound FIDO2 keys give a fake site nothing to relay. Implementation and rollout order are in hardware security keys for METRC logins, patient data, and payment systems. Then remove SMS fallback, or you’ve just bought SMS with better marketing.

Pattern 4: One Flat Network Holding Everything

When a cannabis incident goes from “a laptop” to “the company,” flat networking is almost always the reason. POS terminals, the compliance workstation, the surveillance NVR, back-office PCs, and guest Wi-Fi share a segment; one foothold reaches all of it. This is also how physical security becomes a cyber incident — the NVR and access-control server are network hosts, and compromising them means the evidentiary record your licence depends on is now attacker-editable. See the surveillance attack surface and securing the machine that watches the cameras.

The fix: segmentation, and the version that fits a dispensary rather than an enterprise data center is spelled out in the cannabis network segmentation blueprint. Payments, compliance, physical security, and guest traffic in four zones, with no path between them that isn’t deliberate.

Pattern 5: Nobody Owned the First Hour

The cost difference between a contained incident and a catastrophic one is usually decided before lunch on day one. In cannabis the first hour is harder than in most industries, because the operator has to satisfy three clocks simultaneously: the state cannabis regulator’s incident reporting rule, the privacy regulator’s breach notification deadline, and the cyber insurer’s notice condition. Miss the insurer’s window and a covered loss becomes an uncovered one — what cannabis underwriters actually want to see is worth reading before you need it, not after.

Multi-jurisdiction operators face a worse version: notification clocks running at different speeds in different markets, with different definitions of what triggers them. That’s the practical cost of the classification patchwork.

The fix: a written plan with named humans, out-of-band contact details, and pre-drafted notification templates per jurisdiction. Start from our cannabis incident response template and rehearse it once. The rehearsal is where you discover the compliance officer’s contact list only exists inside the system that’s now encrypted.

What This Means for Where You Spend

Notice what isn’t on the list. Zero-day exploits aren’t a pattern. Nation-state adversaries aren’t a pattern. Novel malware isn’t a pattern. Cannabis loses data to retained ID images, shared platforms, phished passwords, flat networks, and unrehearsed response.

Which means the sector’s spending instinct is backwards. Operators buy detection tooling before they’ve stopped storing passport scans they never needed. Five controls — don’t keep the ID, contract your vendors properly, hardware keys on critical logins, four network zones, one rehearsed plan — would have prevented or blunted essentially every cannabis breach of the past two years, in every jurisdiction.

The data that ends up for sale on criminal markets is almost always data the operator didn’t need to be holding.

Bottom Line

There is no cannabis-specific hacking crew and no cannabis-specific malware. There is a cannabis-specific set of habits, formed by compliance pressure and thin margins, that keeps producing the same five failures across every market on earth.

Pick them off in order. Start with the ID images — that one is free, it’s the largest single source of exposure the industry has, and every day you keep them is a day you’re storing someone’s passport for no compliance benefit at all.