A ransomware group claims it stole data from Pure Options, a Michigan cannabis operator owned by PG Group, including passwords for 577 accounts, payroll records, and signed lease agreements. PG Group has not confirmed this breach. Anyone connected to the company should change passwords immediately and monitor financial accounts closely.
| Company | PG Group (Pure Options) |
|---|---|
| Industry | Retail |
| Data Types Exposed | Login Credentials and Passwords, Administrator Account Passwords, Payroll Reports, General Ledger Records, Signed Lease and Operating Agreements, Internal File Inventory |
| People Affected | 577 accounts |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the PG Group (Pure Options) Data Breach?
A ransomware group has claimed responsibility for stealing internal data from PG Group, which operates the Pure Options cannabis brand in Lansing, Michigan. According to the group’s own claims, the stolen material was not paid for and was instead published online. PG Group has not publicly confirmed this PG Group (Pure Options) data breach as of this writing.
The claim describes a directory database said to contain password information tied to 577 accounts. In addition, the group claims to have obtained a working set of passwords belonging to dozens of staff and administrator accounts. Because this information comes from an extortion group’s leak site, the exact timeline of when unauthorized access occurred has not been publicly disclosed.
Beyond login credentials, the claimed data also includes financial and contract records. These reportedly include payroll reports, general ledgers, and signed lease and operating agreements. The attackers also claim to have copied a full inventory of a shared company data volume, suggesting broad access across internal systems if the claims are accurate.
At this stage, there is no indication that PG Group has issued a statement, opened a formal investigation, or notified affected individuals. As a result, this article treats the incident as an unconfirmed claim rather than an established fact. Readers should understand that details may change as more verified information becomes available.
Who was affected?
Based on the claims, the people potentially affected include current and former employees of Pure Options, along with administrators who managed internal systems. Because payroll reports and general ledgers were allegedly included, the exposure may extend to anyone whose financial or employment data was stored in those files.
The exact number of affected individuals has not been publicly disclosed. However, the claim references 577 accounts tied to a directory database, which suggests the scope could be significant for a single-location cannabis operator. It is not yet clear whether customers, vendors, or landlords connected to the leased properties are also affected.
Since Pure Options operates in Michigan, the impacted population is likely concentrated in that state. Still, employees or contractors who live elsewhere could also be included if they worked remotely or across multiple locations. Until PG Group releases an official statement, the full scope will remain unclear.
What Information Was Potentially Exposed?
The ransomware group’s claims describe several categories of sensitive business and personal data. If accurate, this would represent a serious exposure of both operational and employee-related information.
- Login credentials and password data for 577 directory accounts
- Working passwords for staff and administrator accounts
- Payroll reports
- General ledger financial records
- Signed operating and lease agreements
- Full inventory listing of a shared internal data volume
If these claims are confirmed, the risk to affected individuals could be considerable. Exposed passwords, for example, can let attackers access other accounts if employees reused the same credentials elsewhere. This is especially concerning for administrator accounts, which often control access to broader company systems.
In addition, payroll and ledger data frequently contain names, pay amounts, and sometimes banking details used for direct deposit. Because of this, affected employees could face a heightened risk of targeted phishing emails or fraudulent attempts to redirect their paychecks. Business partners named in lease or operating agreements could also be targeted with convincing scam communications that reference real contract details.
What is the company doing?
Since this incident stems from a ransomware group’s leak-site posting, there is no confirmed public statement from PG Group describing an investigation or response. The source material indicates the demanded payment was not made, after which the group published the data. Beyond that detail, no verified remediation steps have been disclosed.
Because PG Group has not confirmed the breach, it is not yet known whether the company has notified employees, offered credit monitoring, or engaged a forensic security firm. If the company does issue a statement or begin formal notifications, that information would typically come through direct employee communication or a regulatory filing. Readers should watch for updates, since unconfirmed claims can sometimes be followed by official confirmation once a company completes its own review.
What Should Affected Individuals Do?
Change Passwords and Enable Multi-Factor Authentication
Given the claimed exposure of hundreds of account passwords, anyone connected to Pure Options should change their password immediately. This is especially important for staff members, since administrator credentials were specifically named in the claim.
In addition, enabling multi-factor authentication adds a critical layer of protection. Even if a password was exposed, multi-factor authentication can prevent an attacker from logging in without a secondary code. This step is quick to set up and significantly reduces the chance of unauthorized access.
Monitor Financial Accounts and Credit Reports
Because payroll and financial records were allegedly included in the stolen data, affected individuals should watch their bank and credit card statements closely. Look for unfamiliar charges or unexpected account changes over the coming months.
It also helps to request a free copy of your credit report from each major credit bureau. Reviewing these reports regularly can help you catch new accounts or inquiries you did not authorize. If anything looks suspicious, report it right away to limit potential damage.
Consider a Fraud Alert or Credit Freeze
If financial details such as banking information were part of the exposed payroll data, placing a fraud alert on your credit file is a sensible precaution. A fraud alert requires lenders to take extra steps to verify your identity before approving new credit.
For stronger protection, consider a credit freeze instead. This action restricts access to your credit file entirely, making it much harder for identity thieves to open new accounts in your name. Both options are free and can be lifted later once you feel the risk has passed.
Watch for Phishing and Social Engineering Attempts
Because contract and lease agreements were reportedly stolen, scammers could use real business details to craft convincing phishing messages. As a result, employees and business partners should be cautious of unexpected emails referencing payroll, contracts, or account verification requests.
Before clicking any links or providing information, verify the sender through a separate, trusted communication channel. If a message creates urgency or pressure, treat that as a warning sign. Taking a moment to confirm legitimacy can prevent a costly mistake.
Consult a Data Breach Attorney
If you believe your information was included in this claimed breach, speaking with a data breach attorney can help clarify your rights. Many offer free consultations to review your specific situation.
An attorney can also help you understand whether you may qualify for compensation if the breach is later confirmed and formal notifications are issued. Because laws and deadlines vary by state, getting early guidance can help you avoid missing an important filing window.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.