Impersonation Attacks:

It’s no secret that cannabis businesses face more regulation and monitoring than any other industry. Licensees have already jumped through many hoops to obtain their license, and they will do the same to keep it. With this logic, con artists have identified opportunities using impersonation to gain access to the inside of your building or systems. In particular, individuals acting as staff from the C.R.A. (Cannabis Regulatory Agency) are contacting licensees about false upcoming inspections. They are gaining valuable information about the building’s hours of operation, product information, and security to plot their attacks in off hours.

Attackers may also act as the business owner, or someone designated by the owner to arrange pick up or drop off business funds. Innocent employees are under the impression that their superior has given them the direction to comply, and the rest is history.

Vendor impersonation attacks are also on the rise. Communication is received requesting payment in the form of cryptocurrency, but the supposed products are never delivered. There have been mentions made of urgent communications from “vendors” requesting changes to payment directions. Trying to do the right thing, victims help the imposter with whatever they need.

Also reported are attacks of calls from individuals claiming to be calling from the Bureau of Fire Services. Employees are told that they need to drop off items prior to their scheduled inspections. It seems like an innocent request, however the response can divulge important security practices and leave businesses vulnerable.

 Cyber Attacks:

The age of technology has warranted a large wave of cyber-crimes. The booming cannabis industry is fairly new, which leaves uncharted and potentially unprotected territory for criminals to wreak havoc.

The use of phishing has been around for over 2 decades- but is still one of the most frequently used methods for exploitation. Hackers try to lure cannabis business owners into clicking malware-infected links that infect the company’s computer system, potentially costing the business thousands in losses. Most business owners are aware of the danger phishing poses- but these attacks can be hard to distinguish from normal emails or links. Perhaps the most troubling factor of phishing success is that methods continue to develop as technological capabilities expand.

Ransomware attacks also prove effective due to their fear-based approach. Hackers compromise systems to gain control, and give business owners the dreaded ultimatum of complying with their demands, or facing the consequences. The Federal Bureau of Investigations estimates that an average of 4,000 ransomware attacks happen in the United States every single day, and leave business owners with an average of $116,000 in losses to remediate the situation.

Cyber Extortion is similar to ransomware, with one major difference. Criminals only accept the ransom payments via cryptocurrency or other digital avenues. This is to protect their identity and continue their crimes undetected.