Cannabis regulators putting out ‘a series of fires’ involving a Russian oligarch and data breach

Thousands of employees in the Massachusetts cannabis industry received an official email last week about a major data breach: the name, home and email address, phone number and date of birth of every cannabis worker in the state had been made public in an “inadvertent release of agency documents” by the state’s own Cannabis Control Commission. Along with the names and personal information, the dataset included a list of former employees and the specific reasons they were no longer associated with the marijuana company, including alleged violations of company policy.

The state email provided little context for the leak, sparking panic and confusion across online message boards and the local cannabis community. Cannabis workers say they didn’t know what the breach meant for their safety. They also didn’t know that the leak leads back to an investigation into a Russian oligarch and a Belmont-based blogger now hiding in a safe house.

Grant Smith Ellis has been writing about weed since 2017, primarily through an online blog with 25 paid subscribers. Earlier this month, he published a blog post that included internal communications between state commission members discussing an ongoing investigation into alleged financial ties between Massachusetts-based cannabis company Curaleaf and Roman Abramovich, a sanctioned Russian oligarch and confidante of Vladimir Putin.

In response to a public records request, Smith Ellis received the internal communications and a trove of other confidential information — some 17,000 rows of cannabis employees' personal data — due to an error made by the commission. The personal data never went public and his blog post only published details relating to the internal communications between commissioners regarding the Curaleaf investigation.

Two days later, Smith Ellis got an urgent call from officials at the commission, the state’s 100-person cannabis regulatory agency, asking him to remove parts of the post due to “safety concerns.”

“The tone was panic and terror,” Smith Ellis told GBH News. “They asked me to take the story down due to safety concerns … they basically said that leaving this information up could put people at risk.”

Smith Ellis and Eric Casey, who co-authored the blog post and writes about weed on his newsletter Burn After Reading, spoke to commissioners on the call and said they couldn’t get any details about the extent of a potential threat. Because “safety is something that we really care about,” Smith Ellis said, both writers decided to delete the entire post, though they wanted to know more.

“It would be very nice to get some answers,” Smith Ellis said. “I think if there is a threat here to an agency of the state government, that is bigger than just those staff members in that agency, this is about the United States of America and the integrity of this republic. If it was attacked, I want to know.”

A commission spokesperson confirmed the conversation took place. “Given the ongoing and confidential nature of the investigation, the materials should not have been produced or distributed,” the spokesperson said in a statement. “Out of an abundance of caution, the agency also asked the requestor to eliminate any references to implicated staff communications in reporting about the records request and on social media.”

Smith Ellis, who lives in Belmont, went into hiding at a “safe house” elsewhere in the state and temporarily stopped attending classes at New England Law after his professors asked him to avoid the campus out of an abundance of caution.

“The impression that I got was that there was an actionable, credible, imminent threat to the safety of commission staff,” Smith Ellis said.

He’s not the only one who is nervous. Between the commission leaking its own data and looking into a Russian oligarch with ties to Putin, “some staff are pretty freaked out,” a government official with knowledge of the investigation said. “[The Commission] is looking into some powerful people, and staff are asking, 'What can the commission do to protect me?' … but I don't think anything I'm seeing in this scenario justifies a retreat to a safe house.”

In the context of the investigation, there are no current credible threats to the safety of Massachusetts regulators, according to the official who asked to remain anonymous to avoid retribution. “[The commission] is a little fish,” the official said. “There are bigger regulators, so no, [the commission] is not afraid to proceed at all.”

Smith Ellis agreed to delete the files off of his computer, and the commission began a review of standard operating procedures and training for public records “to ensure this situation does not recur,” according to a spokesperson.

“This is now a series of fires on several different fronts, but at this point the best thing is to be honest,” the official said. “This was a mistake. This should have never happened. This was avoidable. This was preventable. And we're going to suffer the consequences as a result.”

In January, the Cannabis Control Commission became the first state agency to launch an investigation into Curaleaf, a locally based company with 146 stores in 21 states, now the largest licensed weed company in the world. Regulators are looking into whether the company and its shareholders violated state law by allegedly accepting millions of dollars in loans from sanctioned Russian billionaire Roman Ambramovich.

Two of Ambramovich’s companies pumped over $400 million into Curaleaf and its top shareholders between 2017 and 2021 via secret offshore accounts, according to financial records leaked on the nonprofit whistleblower website Distributed Denial of Secrets in December and first reported by Forensic News. Following the data leak, internal communications between Massachusetts regulators show concern about possible “red flags'' raised by reporting on possible financial ties.

“This is a matter we will need the feds to advise on before we take action. It’s their guidance/sanctions,” one commissioner wrote to another in an internal exchange obtained by GBH News. Commissioners agreed to focus on investigating agreements, whether ownership was disclosed at any point, and any covenants, or conditions, attached to the loans that could legally be considered “control” over the loan agreements.

Curaleaf’s executive chairman Boris Jordan has repeatedly denied speculation about the company’s ties to Russia. But leaked documents reveal that Ambramovich was quietly funding the company via a British Virgin Islands LLC, Cetus Investments. Ambramovich, who owned the Chelsea Football Club before he was sanctioned, was allegedly referred to by staff at the LLC as “Mr Blue.” The football club’s nickname is “the Blues.”

Ambramovich was sanctioned in Europe, the United Kingdom and Canada in the wake of Russia’s invasion of Ukraine last year. Last summer, the U.S. government obtained a warrant to seize two private jets traced back to the oligarch, saying the billionaire violated strict sanction laws by having the planes flown to Russia without securing licenses or approval.

Massachusetts law requires that cannabis companies disclose the source of their capital, including the names of anyone who might have “direct or indirect control” over the company. Marijuana operators must also certify that all investments were “lawfully earned or obtained.”

Following Massachusetts, regulators in Connecticut and Vermont launched investigations into alleged financial ties between Curaleaf and Abramovich. In February, Curaleaf announced the closure of its operations in California, Colorado and Oregon “as part of its continued effort to streamline its business” according to a report filed with the federal Securities and Exchange Commission.

Curaleaf did not respond to a request for comment. In a statement to CT Insider last month, a representative said that the company has “nothing to hide, and we are disappointed that the continued misguided narrative to malign the company continues among journalistic outlets — despite the absence of any evidence supporting these false and defamatory claims."

Smith Ellis says he plans to return home soon, and feels safer as more information comes out — but he still has questions.

“How did this public records request get filled in a manner that required it to be deleted and had to be clawed back? What happened between Wednesday and Friday that led an agency of the government of Massachusetts to ask two journalists to take down a story after it had been published?” Smith Ellis said. “What scares me more than anything is the unknown."