Customers of cannabis brand Stiiizy Inc. who had personal information exposed during a month-long data breach in late 2024 could receive up to $7,500 each under a proposed class-action settlement now before a federal court in California. The breach, which ran from October 10 to November 10, 2024, triggered formal notifications in at least three states and led to consolidated litigation in the U.S. District Court for the Central District of California. A motion for preliminary approval of the settlement has been filed, and a court-distributed notice has begun reaching affected individuals with details on the payment structure.
Why a $7,500 payout cap matters for Stiiizy breach victims
The proposed settlement puts a dollar figure on the fallout from a breach that spanned 31 days and drew regulatory attention across state lines. Stiiizy Inc. submitted a California breach report cataloged as SB24-597121, covering the October 10 to November 10, 2024 window. The same date range appears in a separate entry maintained by the Maine consumer registry, and the company also shows up in the Massachusetts breach dataset. That three-state paper trail confirms the incident was not isolated to a single jurisdiction.
One early hypothesis is that the $7,500 per-person cap reflects the number of states that received formal breach notices rather than the severity of the data fields exposed. The logic would be straightforward: more states filing means broader legal exposure, which in turn drives a higher settlement ceiling. But the available evidence does not fully support that reading. None of the three state-level filings publicly detail which specific data elements were compromised, making it difficult to separate the influence of geographic scope from the sensitivity of the information itself.
The per-person cap could just as easily reflect the types of records a cannabis retailer collects, which often include government-issued identification, purchase histories, and, in some jurisdictions, medical information tied to cannabis use. Those categories of data can be particularly sensitive because they combine identity details with information about a person’s participation in a still heavily regulated market. Without a public accounting of the exact fields breached, the $7,500 figure sits at the intersection of legal strategy and regulatory pressure rather than mapping neatly onto either variable alone.
For affected customers, the cap frames the upper limit of what they might receive in exchange for giving up individual claims. In practice, only a subset of class members typically file claims, and settlement administrators often prioritize people who can document out-of-pocket losses or time spent dealing with fraud. That creates a hierarchy within the class: those who can show concrete harm may be positioned to seek amounts closer to the cap, while others receive more modest compensation for the risk and inconvenience of having their data exposed.
Court filings and state records behind the settlement offer
The legal case consolidating claims from affected customers is captioned IN RE: STIIIZY, INC., DATA BREACH SECURITY LITIGATION and is proceeding in the Central District of California. A motion for preliminary approval of the class-action settlement has been filed in that court, signaling that the parties have reached terms and are asking a judge to authorize the next steps, including formal notice to class members and a claims process.
The settlement notice itself, distributed through a wire service, states that affected individuals “may receive up to $7,500.” That language sets the upper bound but does not specify the formula for individual payouts. Class-action settlements of this kind typically scale payments based on the number of valid claims filed and the total settlement fund available: the more people who submit claims, the smaller each share becomes. The $7,500 figure represents a ceiling, not a guarantee, and actual payments could end up far lower depending on participation rates and how the court allocates funds among different categories of relief.
The multi-state filing pattern adds weight to the settlement’s scope. California’s Attorney General maintains the breach entry with a direct pointer to the company’s notification, confirming the 31‑day exposure period. Maine’s registry independently corroborates the same breach dates and links to the notice sent to Maine residents, indicating that the incident reached beyond Stiiizy’s home market. Massachusetts includes Stiiizy Inc. as a row in its annual breach reporting dataset for 2025, signaling that residents there were also affected. Each of these filings represents a separate regulatory obligation the company had to meet, and together they form a corroborated record that plaintiffs’ attorneys can cite to establish the breadth of the incident.
In the federal case, the motion for preliminary approval is a pivotal procedural step. If the judge grants it, the parties will move into a formal notice phase, during which class members receive detailed information about their rights, deadlines, and options. Those options usually include submitting a claim form, opting out to preserve the right to sue individually, or objecting to the settlement’s terms. Only after that process and a later fairness hearing would the court decide whether to grant final approval and authorize payments.
What the Stiiizy settlement still does not answer
Several gaps in the public record leave affected customers with limited information. The total number of individuals whose data was exposed has not appeared in any of the state filings or court documents reviewed. California’s breach notification entry and Maine’s registry both confirm the date range but do not publish a victim count. Massachusetts’ spreadsheet includes a row for Stiiizy Inc., but the full details of that entry, including any resident count or data-element breakdown, require downloading and parsing the dataset directly, and those specifics have not been made public in narrative form.
The cause and method of the breach also remain undisclosed in the regulator-hosted notifications. Whether the incident involved a third-party vendor, a direct intrusion into Stiiizy’s systems, misconfigured cloud storage, or some other vector is not addressed in the California, Maine, or Massachusetts filings. That gap matters because the nature of the attack shapes both the risk to affected individuals and the adequacy of any settlement. A breach involving payment card numbers, for instance, carries different long-term implications than one involving only names and email addresses, while exposure of government IDs or medical-use documentation could heighten concerns about identity theft or stigma.
Another unanswered question is how long it took Stiiizy to detect and contain the breach relative to the October 10 to November 10 window cited in state records. Those dates describe the period during which data was at risk, but not when the company discovered the problem or notified law enforcement and regulators. For consumers, the timeline can influence how they assess the company’s response, including whether they feel the settlement meaningfully addresses any delay in warning them.
The structure of the settlement itself is also only partially visible from the public notice language. Many data breach settlements now include non-cash components, such as credit monitoring, identity restoration services, or commitments to upgrade security practices. The motion for preliminary approval is likely to spell out any such obligations in detail, but until a court-approved notice is widely circulated, customers must rely on limited summaries that emphasize the “up to $7,500” figure without fully explaining how security improvements or monitoring might factor into the overall package.
For Stiiizy customers weighing whether to participate, these unknowns make it harder to gauge whether the proposed deal is fair. The settlement offers a path to compensation and some measure of closure, yet it arrives without a public, granular account of what went wrong or how many people were caught up in the breach. As the federal court reviews the proposal and the notice process unfolds, the balance between financial relief, transparency, and long-term safeguards will determine how much reassurance this settlement ultimately provides to those whose data was exposed.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
