Cybercriminals Target Budding Cannabis Retailers

Companies in the young, rapidly growing industry are targeted for sensitive information they store and immature security practices.

As more US states legalize recreational marijuana, security experts warn lawful cannabis retailers of their vulnerabilities to cyberattacks targeting consumer and patient information.

Thirty-four states sell marijuana for medicinal purposes; in January 2020, Illinois will become the eleventh to sell cannabis via state-licensed dispensaries. As Matthew Dunn, associate managing director for cyber risk at Kroll, says, "legitimate cannabis enterprises have all the responsibilities of a traditional business." This means being aware of exposure to cybercrime.

"While they share with all retailers the duty to protect customer data and financial records, cannabis businesses must acknowledge a heightened state of sensitivity around privacy issues," he writes. Dunn argues dispensaries face greater risk due to the controversial product they sell; as a result, it's "imperative" they develop a mature cybersecurity strategy to mitigate risk.

The threat is greater for medicinal marijuana dispensaries, which store protected health information (PHI) records that are considered more valuable to attackers than typical PII due to the extent of health data they contain. Medicinal dispensaries aren't covered under HIPAA, which would limit how they use patient data, but they still must comply with state privacy laws.

What should cannabis retailers watch for? Dunn points to the danger of email-based attacks, which affect retailers across industries but may prove especially prevalent among cannabis companies with relatively new workforces. Cyber extortion is another threat: criminals who access a dispensary's client database could attempt to extort high-profile customers, he adds.

Also top-of-mind is the heightened risk of IoT attacks as many cannabis retailers use video surveillance equipment that connects to the Internet. While IoT devices offer convenience and flexibility of remote access, Dunn points out how many use default login credentials and oftentimes multiple employees will use the same password to access databases and platforms.

Source: Darkreading.com

Powered by NewsAPI.org

Keywords:

Cybercrime • Target Corporation • Cannabis (drug) • Cannabis (drug) • Security • Law • Cannabis (drug) • Cyberwarfare • Consumer • Information • Cannabis (drug) • Illinois • Cannabis (drug) • Matthew Dunn • Risk • Cannabis (drug) • Business • Business • Cybercrime • Retail • Customer • Data • Cannabis (drug) • Business • Government • Privacy • Risk • Computer security • Risk • Medical cannabis • Cannabis shop • Protected health information • Personally identifiable information • Data • Medicine • Health Insurance Portability and Accountability Act • Data • Government • Privacy law • Cannabis (drug) • Retail • Risk • Email • Assault • Industry • Cannabis (drug) • Cyberwarfare • Extortion • Crime • Customer • Database • Cannabis (drug) • Risk • Cannabis (drug) • Closed-circuit television • Internet • Internet of things • Remote desktop software • Login • Password • Database •