Insights
Publications

How to Guard Against 3 Cannabis Cyber Attack Risks

September 1, 2021 Articles
mg Magazine

Cyber attacks are now commonplace. Ransomware attacks, in particular, have skyrocketed in frequency and size. High-profile data breaches have cost businesses in the United States millions of dollars in losses and incalculable reputational harm. Just like those in any other industry, cannabis cyber attack risks pose a clear and present danger of financial consequences.

With new data-security legislation, cyber attacks create even more risk. Under the California Consumer Privacy Act (CCPA), for example, attacks can lead to regulatory fines and private actions by affected consumers. Under the CCPA, consumers are not required to prove personal losses or damage. This increased risk of liability for cyber attacks coupled with the increased volume of attacks makes the issue one that must be addressed by every business. Increasing security is step one, but there is no foolproof protection. Thus, it is equally important to consider how best to insulate companies from potential monetary damage resulting from an attack.

Cyber insurance is no panacea, but it can address cannabis businesses’ cyber risks, including the one described above. It also covers the cost of investigating and responding to data breaches and ransomware attacks, as well as some lost profits due to computer system downtime.

As valuable as these basic coverages are, cannabis businesses have unique risks that make them more vulnerable to cyber attacks and their financial consequences. Cannabis producers and retailers should carefully consider their other, possibly bigger, cyber risks and seek to address them when buying cyber insurance.

There is no “standard” cyber insurance policy. Dozens of insurers sell such a product, with each insurer constantly adapting its policy terms to market changes and challenges. As a result, cannabis businesses must carefully review policies offered to them and negotiate the terms in order to address their individual cyber risks. Those that fail to do so may leave some of their biggest risks uncovered.

We focus on three such risks here.

1. Retailers face acute reputational risks associated with data breaches.

Retailers collect and hold highly sensitive personal information, including, in some cases, personal health information. The sensitivity arises not only from the type of information, but also its potential to reveal the relationship between the consumer and retailer. Many customers rely on retailers to keep their purchases hidden from public view. As a result, a data breach publicizing the personally identifiable information from a cannabis retailer’s customer list may cause real-life consequences to those individuals whose information is disclosed. While cyber insurers typically defend lawsuits seeking such damages, cyber insurance policies often do not cover the lost profits the retailer will suffer as consumers flee to its competitors, which may be perceived as better safeguarding confidentiality. Some cyber insurers offer this coverage, though, and cannabis retailers should try to purchase it.

2. Growers and producers may suffer damage to or loss of property that is not easily insured.

Cultivators’ operations may depend, at least in part, on computers. A cyber attack or other event impacting those computers has the potential to damage cannabis crops by interfering with or hampering growth or harvesting operations. Both grape growers and cannabis cultivators lost crops to California wildfires over the past few years, but there is one critical difference between the two groups: Grape
growers can purchase federally backed crop insurance, whereas cannabis growers cannot. Policies that would cover cannabis growers for damages resulting from cyber attacks—cyber insurance—typically exclude coverage for property damage. As a result, cannabis growers and producers should work closely with their insurance brokers and counsel to seek coverage for this risk.

3. Businesses struggle with contradictions created by conflicting state and federal laws.

Insurance is no exception to the federal-state dichotomy cannabis businesses face. Cyber insurance policies may require, as a condition of coverage, the insured business notify law enforcement of a cyber attack, such as a ransomware attack. Cannabis businesses must scrutinize such provisions when they shop for cyber insurance to ensure policies do not place them in a Catch-22 situation when the time comes to make a claim. It is possible to negotiate the deletion, or at least modification, of these kinds of provisions so that they do not create impossible roadblocks to coverage.

Cannabis businesses commonly navigate legal and regulatory minefields. They can successfully navigate this one, too, with advanced planning and reliance on the advice of their insurance brokers and counsel. They should give careful consideration to the types of attacks their particular businesses are likely to suffer and the financial losses such attacks could produce. They should work to prevent and mitigate the potential impact of such attacks by employing up-to-date security practices and remaining constantly aware of their information-technology security. Finally, they should understand their remaining computer security and financial vulnerabilities and proactively seek to address them with cyber insurance.

Firm Highlights

News

Ryan Lowther Named Among Top Cannabis Lawyers in California by the Daily Journal

Ryan Lowther headshot
Read More
News

Farella Braun + Martel Ranked in Legal 500 United States 2022

The Legal 500 United States  2022 guide has recognized Farella Braun + Martel among the leading firms in the Cannabis, Construction, and Land Use/Zoning sections. Land use partner Steven Vettel is named to the Land...

Read More
Publication

New California Bill Requires Employers to Offer Bereavement Leave

AB 1949 , a bill passed by the California legislature and awaiting Governor Newsom’s signature, would require California employers to offer five days of bereavement leave to employees each time they lose a spouse...

Read More
Publication

Preparing Your Cannabis Business for California’s New Employment Laws in 2022

Chandra Andrade and Rebecca Stephens discuss "Preparing Your Cannabis Business for California’s New Employment Laws in 2022" at our Cannabis Industry Education Series. Each year in California, the new year brings new employment laws for businesses to...

Read More
News

Jeff Hamilton Listed Among Top 200 Cannabis Lawyers by Cannabis Law Report

Farella Partner Jeff Hamilton has been listed among the Global Top 200 Cannabis Lawyers 2022/2023 by Cannabis Law Report. In his cannabis practice, Jeff represents investors and investment funds, cultivators, manufacturers, distributors, and ancillary businesses...

Read More
Publication

Cannabis Farms in the Neighborhood: Water, Contaminants and Other Proximate Matters

Farella's Buzz Hines, and guest speakers Kari Campbell-Bohard from EpicVeg and Lompoc Valley Cooling and Robert Schultz from Geo Blue Consulting, for a discussion on "Cannabis Farms in the Neighborhood: Water, Contaminants and Other...

Read More
News

Farella Attorneys Named to 2022 Northern California Super Lawyers and Rising Stars

Thirty-four Farella Braun + Martel lawyers were named to the Super Lawyers and Rising Stars lists of top attorneys in Northern California for 2022. Super Lawyers: Carly Alameda – Business Litigation George Argyris &ndash...

Read More
Publication

Survey of Pay Disclosure Laws Across the Country

There has been a wave of new state and local legislation focused on pay transparency for job applicants. Right now, Colorado State and Jersey City are the only jurisdictions that require employers to provide...

Read More
Publication

California’s Pay Transparency Act (SB 1162) – Are You Prepared?

This week the California legislature passed a pay transparency act that – pending Governor Newsom’s signature – will require significant changes in how employers draft job postings and how they report pay data to...

Read More
News

Julie Treppa Elected Fellow of American College of Tax Counsel

Julie Treppa headshot
Read More