No, you can no longer join the STIIIZY data breach lawsuit. Claim forms were due Sept. 10, 2026, and final approval was entered Oct. 26, 2026.
The case is In Re: STIIIZY Inc. Data Breach Security Litigation, No. 2:25-cv-00490 in the Central District of California. It concerns an October 2024 incident where information was stolen from STIIIZY servers, which STIIIZY denies involved legal violations, according to the final approval update.
Official resources:
- Explore the official data from Baretnews — Use this primary source to review the underlying data.
- Explore the official data from Lawfold — Use this primary source to review the underlying data.
Table of Contents
- Who qualified for the class?
- What happened in the breach?
- What did the settlement offer?
- Why did the deadline close everything?
Who qualified for the class?
The class covered all persons whose personally identifiable or private health information was accessed, compromised or stolen in the incident STIIIZY announced Jan. 7, 2025.
It also included a subclass for California residents doing business with the company. That definition was published in the court-authorized notice shared by Baret News. In practice, eligibility turned on the breach notice:.
- You received a notice tied to the January 2025 STIIIZY announcement.
- Your identifying or health-related information was listed as affected.
- California residents could fall under the added subclass.
What happened in the breach?
STIIIZY learned of the intrusion on Nov. 20, 2024 from a point-of-sale vendor. Attackers had access roughly Oct. 10 to Nov.
10, 2024, affecting four retail locations in San Francisco, Alameda and Modesto. About 380,000 consumers were notified, SecurityWeek reported in its breach coverage. Compromised data included government IDs such as driver's licenses, medical cannabis cards, names, addresses, dates of birth and dispensary transaction information. STIIIZY told California's attorney general that its vendor attributed the compromise to an organized cybercrime group. TechCrunch reported that customer ID documents including passports and medical cards were acquired, as described in its account of the disclosure.
What did the settlement offer?
The settlement created a $2.95 million fund with three options. Class members could seek documented-loss reimbursement up to $7,500 with receipts, a pro-rata cash payment requiring no documentation, or two years of three-bureau monitoring with $1M identity-theft insurance. Those benefit details were summarized by LawFold in its settlement breakdown.
The cash option helped people without receipts or with limited losses. The reimbursement option fit people with bills, fees or other provable costs. The monitoring option addressed future identity-theft risk rather than past spending.
Why did the deadline close everything?
Only people who submitted a timely valid claim form could receive money or monitoring. Doing nothing yielded no benefits but still bound the person to the settlement's release of claims. The opt-out and objection deadline was Aug. 26, 2026.
The final-approval hearing was Oct. 19, 2026, followed by final approval on Oct. 26, 2026. Those closed dates leave no path for a new claim, exclusion or objection.