In September 2026, identity verification vendor IDScan.net reported discovering unauthorized access within its cloud environment, potentially exposing customer identification data processed for client companies, including cannabis retailer Planet 13 Holdings Inc. According to reports, the vendor discovered the unauthorized activity on September 1, 2026, and determined by September 4 that stored information had potentially been accessed or copied.
The information involved in the incident reportedly includes consumer names, driver's license numbers, and other government-issued identification numbers, along with scanned photo IDs submitted during transactions. An official count of affected individuals has not been publicly released by Planet 13 or regulators, and the precise number of impacted customers remains unconfirmed.
Because forensic reviews and third-party data reconciliations frequently take time to conclude, additional details concerning the scope of exposure or downstream notices may develop over time. A federal lawsuit related to the incident has been filed against Planet 13 Holdings Inc. in the U.S. District Court for the District of Nevada.