Cannavative Group, a US-based company, suffered a ransomware attack by the Nightspire group on March 13, 2026. This incident was discovered on March 22, 2026, and was reported by security researchers.
The stolen data includes QuickBooks files, METRC database, and employee and client documents. The estimated number of affected individuals and specific states affected are unknown. It is not publicly confirmed if the exposed data included Social Security numbers, medical information, or financial data, although QuickBooks files and employee documents may suggest this possibility.
The full extent of this data breach may emerge with time, as official notifications can sometimes be delayed.