Stiiizy Data Breach Settlement Worth $2.95 Million for Customer Data Protection

In October 2024, vaping and cannabis device brand Stiiizy disclosed that an unauthorized party accessed personal information for about 387,555 current and former customers and other individuals. People who received notice may be able to participate in a class action settlement, with potential benefits that include reimbursement for certain documented losses (up to $7,500) and options like two years of credit monitoring and identity theft restoration support. The case centers on allegations that Stiiizy did not put adequate safeguards in place to protect sensitive customer data, even though companies in the digital economy are expected to use reasonable security practices to prevent breaches and limit harm when they occur. The lawsuit was filed to hold the company accountable for the breach and to compensate affected customers, which is why the settlement provides cash and credit-protection services instead of requiring each person to sue individually. Stiiizy agreed to pay $2.95 million to resolve the claims, and the settlement includes funds for administration, attorneys’ fees, and service awards, as well as support for claimants through credit monitoring and identity theft insurance/restoration. It also reflects a common pattern in privacy litigation: the company typically denies wrongdoing but settles to avoid the uncertainty and expense of trial, while the agreement often requires improved cybersecurity practices and creates a formal process for customers—whether or not they received notice—to submit claims. Broader implications include the way these cases reinforce evolving expectations under U.S. data-breach and privacy rules, especially state laws like California’s data privacy framework (and related breach notification requirements) that have driven stricter compliance and public accountability. Similar class actions have been filed across many tech and consumer industries whenever businesses experience unauthorized access to personal data, and regulators and courts increasingly look at whether “reasonable” security controls were in place and whether customers received timely, clear information. In this settlement, eligibility hinges on U.S. residence and whether the breach involved personally identifiable information or private health information, and the process includes required documentation for losses claims, with benefits distributed after final court approval—so for many affected individuals, the key next step is submitting a claim by the deadline to obtain the settlement support they may be entitled to.