Recently, Unrivaled Brands dba Silver Streak, Inc. reported a data breach stemming from a misconfigured web application that caused personal information to be accessible on the company’s website. According to Silverstreak, the breach resulted in the names, dates of birth, addresses, driver’s license numbers, and email addresses of certain individuals being compromised. On June 17, 2022, Silverstreak filed an official notice of the breach and sent out data breach letters to all affected parties.
If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Silverstreak Solutions data breach, please see our recent piece on the topic here.
What We Know About the Silverstreak Solutions Data Breach
According to an official notice filed by the company, on April 6, 2022, SilverStreak discovered an inadvertently misconfigured web application causing certain individuals’ personal information to be accessible on the company’s website. In response to this discovery, Silverstreak took down the page and consulted with cybersecurity experts to determine whether any sensitive consumer data was leaked as a result of the incident. Silverstreak also de-indexed its website to limit traffic through search engines.
On May 4, 2022, the company’s investigation revealed that certain information was exposed to the public before the site was taken down. While the breached information varies depending on the individual, it may include your name, date of birth, address, driver’s license number, and email address.
On June 17, 2022, Silverstreak Solutions sent out data breach letters to all individuals whose information was compromised as a result of the recent data security incident.
More Information About Unrivaled Brands dba Silver Streak, Inc.
Silver Streak is a direct-to-consumer cannabis delivery company based in Sacramento, California. As of November 2021, Silverstreak is a wholly-owned subsidiary of the cannabis company Unrivaled Brands. Unrivaled Brands is a vertically-integrated cannabis multi-state operator and the parent company of multiple other cannabis companies. Unrivaled Brands employs more than 330 people and generates approximately $39 million in annual revenue.
Can a Company Be Liable for an Accidental Data Breach?
Based on the company’s filings, it appears that the Silverstreak data breach was unique in that it did not involve a hacker or other cybercriminal bypassing the company’s IT security system. Instead, the breach was the result of an accidental misconfiguration related to the company’s app. While the Silverstreak breach is different from most breaches being reported these days, data breach laws apply with the same force whether a breach was the result of a third party’s intentional actions or an employee’s mistake. In fact, some would argue that a company that leaks information by accident is more negligent than one that is the target of criminal conduct.
Determining if a company is negligent is important because, regardless of how a data breach occurs, a company may be held liable for any resulting damages if victims of the breach can prove the breach was the result of the company’s negligence. In data breach cases involving cyberattacks, the question usually comes down to whether the organization’s data security system was sufficient to detect and prevent cyberintrusions.
However, in cases such as the Silverstreak data breach, the adequacy of the company’s IT security system isn’t at issue. Thus, the question is much simpler. Simply put, whether Silverstreak or its parent company Unrivaled Brands, is financially liable for the breach boils down to whether the organization’s actions in accidentally posting the patient data were negligent. Of course, it’s too early to tell if Silverstreak bears responsibility for the breach. However, data breach lawyers will be reviewing affected parties’ options to hold the organization liable as additional information about the incident becomes available.
https://www.jdsupra.com/legalnews/cannabis-delivery-company-unrivaled-9050974/
