OLYMPIA – Washington marijuana businesses are struggling after a data breach to the state’s online tracking system allowed hackers to access information on delivery vehicles, routes and approximate travel times.
The security breach was announced Thursday, days after the system host, MJ Freeway, became aware of the problem. A statement by the Washington Liquor and Cannabis Board said no personal identifying information was stolen.
Data accessed from the hack included information such as delivery routes and manifest times between Feb 1 and 4; VIN, license plate numbers; and vehicle types used in transportation.
Washington requires extensive tracking of marijuana products, including how and where they are delivered.
Cip Paulsen from Growstate One said the information hack made him worry about robbery or carjacking.
Sam Calvert, owner of Greenstar Cannabis, said he’s always careful about security, but the information downloaded is dangerous.
“Seeing these approximate times, that provides the opportunity for someone to actually prep and be strategic,” he said. “That kind of stuff worries me.”
The breach happened just days after the implementation of Leaf Data Systems on Feb. 1.
The new data system had been scheduled to take effect in November but was rescheduled multiple times after the original company backed out and was replaced by MJ Freeway.
The hack is not the first time MJ Freeway has run into security problems. Another hack in January 2017 included information like client birth date and contact information. Another resulted in part of the system’s source code being stolen.
The security breach has brought the industry to a standstill, said Crystal Oliver, co-owner of Washington’s Finest Cannabis. She said it necessitated updates to the current software, which slowed down deliveries.
“We haven’t been able to transfer product to any stores,” she said. “We’re looking at a week’s loss in revenue.”
Because of the data breach and other technical problems, Oliver said she spent upward of 15 to 20 hours trying to get her product to vendors, and is frustrated there was not more testing before the system was launched for hundreds of business owners.
She said her biggest frustration is that the data system was implemented before it was ready.
Calvert said he also spent hours problem-solving because of the breach, but inadequate online security is just part of the problem. The hack follows a series of technological issues that have made marijuana business in Washington difficult.
Even as deliveries resume, growers and distributors are struggling to stock shelves as many orders are canceled or rejected because of problems with the system.
“Producers and processors are pulling their hair out because they can’t even get their product manifested,” Calvert said.
Jon Sahlberg, a transporter who works with growers in the Spokane area, said he’s had shops turn away deliveries because they could not legally accept them.
Because Sahlberg doesn’t deal directly with traceability, he can’t know until he shows up if stores are able to take the product.
“This week, I think (I had) over 30 rejected deliveries,” he said. “There’s been a lot of time and money wasted because of this transition.”
Those deliveries still cost growers, regardless of whether they make it to the shop or not.
“Not only are they incurring double the cost of our delivery prices, they’re incurring more time and more labor to remanifest everything,” Sahlberg said. “Most of these producer-processors, they live week-to-week.”
Both Paulsen and Oliver said they don’t expect to be making deliveries until next week. This means missing out on Friday and Saturday, which are the biggest days for marijuana sales.
“I would put it at roughly $70,000 to $40,000 in lost sales because this stuff isn’t on the retailer’s shelves,” Paulsen said.
For shop owners, the products that are being delivered require more time spent to meet regulations.
Some products are missing bar codes used for tracking, Calvert said. All of his inventory is being automatically registered as one gram, meaning he has to manually change the units to comply with state regulations.
“My time (spent) has quadrupled over the past two days,” he said.
Calvert can make changes to accommodate as best he can in his store, but doesn’t feel hopeful about state regulations, he said.
“I’d like to see a new group of people in charge of this industry,” he said. “At any corporation where this sort of consistent error was happening, people’s heads would roll.”