The Lazarus Naturals lawsuit most people are searching for is the 2023 data breach class action, which the Portland-based CBD company settled for $300,000 in November 2024. The company and its sister brand Cycling Frog have also resolved a California Proposition 65 enforcement action over THC warnings, and Cycling Frog filed a separate challenge to New York’s hemp-THC regulations in August 2023.
The Data Breach Class Action
Between March 1 and June 2, 2023, an attacker exploited a software vulnerability on the Lazarus Naturals website and inserted malicious code into the company’s systems. The intrusion exposed customer names, billing addresses, credit and debit card numbers, expiration dates, and card security codes. The company said Social Security numbers, dates of birth, and driver’s license numbers were not accessed.1teiss. Cyber Attack on Lazarus Naturals Impacted More Than 40,000 Customers
Lazarus Naturals identified the breach on July 10, 2023, notified affected customers, and reported to the Maine Attorney General’s Office that at least 42,000 people were affected.1teiss. Cyber Attack on Lazarus Naturals Impacted More Than 40,000 Customers
On August 14, 2023, plaintiff Deborah Cimino filed a class action complaint against ETZ Hayim Holdings, S.P.C., the parent company doing business as Lazarus Naturals, in the U.S. District Court for the District of Oregon. The case, Cimino et al. v. ETZ Hayim Holdings, S.P.C., d/b/a Lazarus Naturals, No. 3:23-cv-01185-JR, alleged negligence, breach of implied contract, violations of state consumer protection and privacy statutes, and failure to meet Payment Card Industry Data Security Standards.2Simpluris. Cimino v. ETZ Hayim Holdings Complaint
What the Settlement Provided
The parties agreed to a $300,000 non-reversionary settlement fund, meaning the full amount was committed regardless of how many people claimed. Class members could choose one of two options:
- Reimbursement of up to $5,000 per person for documented out-of-pocket losses tied to the breach, supported by records such as bank statements, invoices, or receipts.
- A pro-rata cash payment sharing whatever remained in the fund after administrative costs, attorney fees, and documented-loss payouts.
Attorney fees were capped at $75,000, and the two named class representatives were eligible for service awards of up to $5,000 each, subject to court approval.3Simpluris. ETZ Data Breach Settlement Notice
Current Status
Judge Jolie A. Russo granted final approval on November 21, 2024.4Bloomberg Tax. Lazarus Naturals to Pay $300,000 to Settle Data Breach Suit The claim-filing deadline was October 16, 2024, and the deadline to opt out or object had passed on September 16, 2024. The settlement is listed as closed, with no reported appeals.5ClaimDepot. Lazarus Naturals Data Breach Settlement If you missed the claim window, there is no further route to compensation under this settlement.
The California Proposition 65 Action
Environmental Health Advocates, a private enforcer under California’s Proposition 65, brought an action against both Lazarus Naturals and Cycling Frog over THC-containing products sold in California. The notices alleged the companies failed to provide adequate warnings about exposure to THC, which is listed under Proposition 65 as a chemical known to the state to cause reproductive harm.6California Office of the Attorney General. EHA v. Lazarus Naturals and Cycling Frog Prop 65 Settlement
The parties settled on June 2, 2025. The agreement required Lazarus Naturals and Cycling Frog to begin providing “clear and reasonable” Proposition 65 warnings on covered California products within 60 days. The financial terms were a $2,000 civil penalty and $18,000 in attorney fees and costs, totaling $20,000. The settlement was not submitted to a court for approval.7California Office of the Attorney General. Proposition 65 Notice 2024-04923 Both companies denied the allegations, and the settlement stated that it was not an admission of any violation.6California Office of the Attorney General. EHA v. Lazarus Naturals and Cycling Frog Prop 65 Settlement
Cycling Frog’s New York Regulatory Challenge
In August 2023, Cycling Frog, the hemp-derived THC beverage brand owned by the same parent company, led a legal challenge against New York’s Office of Cannabis Management over emergency regulations. The OCM rules capped ingestible products at 10 milligrams of total THC per package, 1 milligram per serving, and barred sales to anyone under 21 for products exceeding 0.5 milligrams of THC per serving.8BevNET. Cycling Frog Leads Legal Fight Against NY State Hemp Regulations
On August 5, 2023, Cycling Frog filed an Article 78 special proceeding in Albany County Supreme Court alongside the Hemp Beverage Alliance, retailer One Stop Brew Shop, and distributor Sarene Craft Beer. The plaintiffs sought to permanently block the regulations, arguing they violated New York’s Marihuana Regulation and Taxation Act of 2021 and were arbitrary and without rational basis.8BevNET. Cycling Frog Leads Legal Fight Against NY State Hemp Regulations
The NBC Lead Report Was Not a Lawsuit
An NBC investigative report flagged a product labeled as Lazarus Naturals for containing lead after Evio Labs in Miami rejected one of five samples that NBC had purchased through an independent seller on Groupon. No litigation resulted from the report. Lazarus Naturals said the flagged product lacked a batch number that would confirm it was genuine, noted that Groupon is not an authorized sales channel, and stated that the lead level detected was approximately 1.7 micrograms per serving, below the FDA’s Interim Reference Level of 3 micrograms per day for children and 12.5 micrograms per day for adults. Products NBC bought directly from the company’s own website passed a full testing panel.9Lazarus Naturals. Official Statement Re: NBC Lead Results Report