Dear business license holder, 

We want to make you aware of a recent phishing scheme targeting licensed businesses. Some businesses have reported receiving emails that appear to come from official sources, asking recipients to follow a link and update business information. These emails are fraudulent and should not be trusted. 

What you should do: 

• Do not select any links or provide personal/business information in response to suspicious emails. 
• Verify the sender: Official communications from OCM will come from email addresses with the following domains: state.mn.us, public.govdelivery.com, accela.com, or billerpayments.com.
• Report suspicious emails: Forward suspected phishing attempts to your IT team for investigation. 
• Access official resources directly: If you need to update your business information, always go to our official website (https://aca-prod.accela.com/MDH) by typing the URL into your browser rather than using links in an email. 
• Use official channels: When in doubt, contact the sender through official channels to confirm legitimacy. 

Why is my contact information public data? 

It appears that senders of the phishing emails obtained business contact information from OCM’s list of licensed businesses that is posted on OCM’s website. State statute (Minnesota Statutes, section 342.20, subd. 3) specifies exactly what information about a license holder is public, including your name, business name, location, license type, contact email address, your license number, whether you are a social equity classified business, the date when your license was issued, and when it will expire.  

Information that is not available to the public includes identifying information about your customers, data identifying employees, tax information, business plans, and certain information regarding any pending civil legal actions.  

Your vigilance helps protect your business and our community from cyber threats.  

Thank you for your attention to this matter. 

Regards, 

Office of Cannabis Management