Pro

SCOOP: Eaze hit by data breach

By Alex Halperin
Apr 20, 2022
story-image

A data breach compromised the personal information of present and former employees at delivery app Eaze, according to current and former employees. The leak represents the latest challenge for the company as it adjusts to the merger with Colorado-based retailer Green Dragon.

  • Eaze handles one third of legal deliveries in California, a current executive said.

On April 13, Eaze engineer C.J. Silverio tweeted about a “data breach that leaked the W2s for every one of my employer’s California employees.” In the thread she attributed it to human error.

“Identifying myself to the IRS via video selfies and some other quite interesting (and tbh reassuring) means,” she tweeted minutes later. “Well probably my federal tax return was not filed fraudulently so that is good!”

  • An outside spokesperson for Eaze didn’t respond to multiple requests for comment. [UPDATE: The company provided this comment: “Eaze is aware of an isolated breach of internal company data which affected Eaze employees in California. No customer data was impacted. The company has taken steps to mitigate this breach.” — Ro Choy, CEO, Eaze.”]

A former Eaze employee told WeedWeek that the breach occurred when a corporate worker fell for a “phishing scam.” The former employee said that weeks ago “someone filed a fraudulent return with my info and got a [more than $1,000] refund.”

  • (The former employee provided a screenshot from the California Franchise Tax Board [clarification added] for WeedWeek to review which appeared to confirm this. We are not publishing the exact date or dollar amount to protect the individual, who spoke on condition of anonymity.)
  • The former employee said they first heard of the breach from other affected colleagues before hearing about it from the company last week.
  • As restitution the company has made “vague promises of 2 years of credit monitoring,” according to the former employee.
  • Another former employee whose data was compromised told WeedWeek it was an accident.

News of the data breach comes as Eaze negotiates a contract with unionized drivers at a San Francisco depot.

WeedWeek* previously reported that Eaze is working with Fisher Phillips, a law firm specializing in what a professor of labor law called “union avoidance activity.” The company has denied being anti-union.

  • The company and San Francisco union held negotiations this week. United Food and Commercial Workers (UFCW) Local 5 organizer Jim Araby said the negotiations would continue, but declined to comment further.
  • On the afternoon of Wednesday April 20, Araby and a driver in the union, Lay Lay Lee-Aquila, both said they had not heard of the data breach.
  • The former employee whose identity was apparently stolen speculated that the drivers’ data had “probably” not been affected since they worked for a subsidiary of the company.
  • This month the UFCW Local 7 in Colorado alleged that the company used hardball anti-union tactics at a Denver grow house.

Eaze’s face-offs with workers comes at what Araby had previously considered one of the more union friendly cannabis operators in California. 

  • Current and former Eaze employees have told WeedWeek that they believe Green Dragon is now setting the company’s tone.
  • Silverio, the engineer who tweeted about the data breach had tweeted the day before that she “shouted down,” Eaze CEO Ro Choy, who had led Eaze before the merger.
  • The incident highlighted doubts that Choy was in charge, current and former employees said.

A current executive at the company, who spoke on condition of anonymity, rebutted that view. Like any merger, the executive said it required adjustments from both sides, “There’s always a need for compromise between counter parties.”

The exec ascribed a raft of departures from Eaze’s pre-deal management team as the kinds of tough choices the company needed to make to reach profitability, which the executive expects this year. 

  • In November, then Green Dragon Chief Development Officer Alex Levine told WeedWeek that the combined company was profitable. The comment came after the merger had been announced but before the formal close this winter.

One complicating factor in merging the companies is that Green Dragon had essentially been a family run operation, according to the current executive, and current and former employees.

  • The executive said Green Dragon, which also operates in Florida, accounted for about 30% of the combined companies’ revenue and has two seats on the eight person board. Levine and Lisa Leder hold those seats.
  • The company has not responded to requests to say who’s on its board or management team.
  • In February, CEO Choy, who’s also on the board, sent an email to staff identifying Levine as Chief Development Officer, Levine’s father Andy as president of operations and the elder Levine’s wife Lisa Leder as president of real estate.

Leder is the ex-wife of private equity executive Marc Leder. During their divorce she reportedly estimated their marital estate at $400M and rejected an offer that, according to her ex’s divorce lawyer, would have made her one of the wealthiest women in Florida. It’s not clear what she received in the settlement.

  • Her ex-husband hosted the 2012 fundraiser when Republican presidential candidate Mitt Romney said 47% of Americans pay no taxes and expect the government to support them.