Seattle, Washington-based CBD oil manufacturer Lazarus Naturals said it suffered a cyber attack that compromised the sensitive personal information of more than 40,000 customers.
Lazarus Naturals is a leading manufacturer of cannabidiol (CBD) oil, known for its calming and pain-relieving properties, as well as wellness products like oil tinctures, soft gels and capsules, concentrates, and pet products.
In a recent filing with the Office of the Attorney General of Maine, Etz Hayim Holdings, S.P.C., which operates the brand name Lazarus Naturals, said that on 10th July, it identified a cyber security incident that compromised certain personal information of its customers. Immediately after learning about the security incident, Lazarus Naturals launched an investigation to understand the source and scope of the same.
The company’s investigation revealed that “the incident was caused by one or more malicious actors who exploited a software vulnerability on our website allowing them to insert malicious code facilitating the compromise.
“Based on the investigation, it appears the Incident occurred at Lazarus Naturals at certain points between March 1 and June 2, 2023,” the company said.
According to the company’s investigation, the compromised information included customers’ names, billing addresses, and financial information including credit and debit card information, card numbers, expiration date, and the card security code. Lazarus Naturals has, however, clarified that if a customer has checked in as a registered user during the time period using stored payment and delivery information, then that data “may not” have been accessed by the intruder.
“Based on our investigation to date, we do not believe Social Security numbers, dates of birth, or driver’s license numbers were included in the breach,” the company added.
The filing with the Maine Attorney General’s Office confirms that at least 42,000 individuals were affected by the data breach.
“Lazarus Naturals takes this Incident and the security of your personal information very seriously. Upon learning of this incident, we launched an in-depth investigation to determine the scope of the Incident and identify those potentially affected.
“This included working with our information technology team and engaging third-party forensic experts in an effort to ensure the Incident did not result in any additional exposure to personal information and taking steps to confirm the integrity of Lazarus Naturals’ systems,” the data breach notice reads.
Lazarus Naturals said it also reported the incident to the Federal Bureau of Investigation and is offering two years of complimentary identity monitoring, fraud consultation, credit monitoring, and identity theft restoration services through Equifax to all customers who have been affected by the data security incident. Also, a dedicated helpline has been set up where affected customers can call and get their queries resolved.
