Company Details
turning-point-brands-inc.
234
5,275
30
turningpointbrands.com
0
TUR_1389942
In-progress

Turning Point Brands, Inc. Company CyberSecurity Posture
turningpointbrands.comTurning Point Brands, Inc. (NYSE: TPB) is a leading, manufacturer, marketer and distributor of branded consumer products with active ingredients. We sell a wide range of products exclusively to adult consumers, from our iconic brands to our next generation products to fulfill evolving consumer preferences. Our three focus segments are led by our core, proprietary brands including Zig-Zag® (rolling papers and wraps), Stoker’s® (looseleaf chew and moist snuff) along with our distribution platforms (VaporBeast®, VaporFi® and Direct Vapor®) in NewGen. Our products are sold in over 215,000 retail outlets in North America and through our e-commerce platforms such as www.zigzag.com. Our businesses generate solid cash flow which we use to finance acquisitions, increase brand support, expand our distribution infrastructure, and strengthen our capital position. The world-famous Zig-Zag® brand has a proud heritage of leadership dating to 1879. Zig-Zag® is the leading premium paper in both the U.S. and Canada. Over the past decade, Zig-Zag® has successfully expanded its consumer base into new product categories such as cigar wraps, hemp paper and paper cones. In 2022, we entered into an exclusive distribution agreement for CLIPPER® lighters (the world's leading reusable lighter) in the U.S. and Canada. The Stoker’s® brand has a proud heritage dating to 1940. Stoker’s competes in the chewing tobacco segment, where it has grown to the #1 position, and in the moist snuff segment, where it remains one of the fastest-growing brands. The portfolio also includes Beech-Nut®, launched in 1897, and a diverse collection of other chewing tobacco brands that offer a variety of consumer choices and tastes. Our NewGen vapor portfolio includes our B2B (Vapor Beast®), B2C (International Vapor Group®) vape distribution platforms.
Company Details
turning-point-brands-inc.
234
5,275
30
turningpointbrands.com
0
TUR_1389942
In-progress
Between 700 and 749

TPBI Global Score (TPRM)XXXX

Description: The California Office of the Attorney General reported a data breach involving International Vapor Group on March 12, 2019. The breach occurred on June 30, 2018, resulting in the compromise of customers' names and credit or debit card information due to unauthorized access to their e-commerce site.
Description: The Maine Office of the Attorney General disclosed a data breach affecting **Vaporfi.com** (and its associated platform, Directvapor.com) on **December 21, 2020**. The incident stemmed from **unauthorized access to the company’s online payment platform**, discovered on **September 23, 2020**. The breach exposed **credit and debit card information** of **10,544 individuals**, including **3 Maine residents**. While the exact method of intrusion remains undisclosed, the compromise of financial data suggests a targeted cyber intrusion aimed at exploiting payment processing vulnerabilities. The exposed information poses risks of **fraudulent transactions, identity theft, and financial losses** for affected customers. The breach underscores the critical need for robust payment system security, particularly in e-commerce platforms handling sensitive financial data. No evidence suggests broader data exfiltration beyond payment details, but the incident highlights vulnerabilities in third-party payment integrations or internal security controls.


No incidents recorded for Turning Point Brands, Inc. in 2025.
No incidents recorded for Turning Point Brands, Inc. in 2025.
No incidents recorded for Turning Point Brands, Inc. in 2025.
TPBI cyber incidents detection timeline including parent company and subsidiaries

Turning Point Brands, Inc. (NYSE: TPB) is a leading, manufacturer, marketer and distributor of branded consumer products with active ingredients. We sell a wide range of products exclusively to adult consumers, from our iconic brands to our next generation products to fulfill evolving consumer preferences. Our three focus segments are led by our core, proprietary brands including Zig-Zag® (rolling papers and wraps), Stoker’s® (looseleaf chew and moist snuff) along with our distribution platforms (VaporBeast®, VaporFi® and Direct Vapor®) in NewGen. Our products are sold in over 215,000 retail outlets in North America and through our e-commerce platforms such as www.zigzag.com. Our businesses generate solid cash flow which we use to finance acquisitions, increase brand support, expand our distribution infrastructure, and strengthen our capital position. The world-famous Zig-Zag® brand has a proud heritage of leadership dating to 1879. Zig-Zag® is the leading premium paper in both the U.S. and Canada. Over the past decade, Zig-Zag® has successfully expanded its consumer base into new product categories such as cigar wraps, hemp paper and paper cones. In 2022, we entered into an exclusive distribution agreement for CLIPPER® lighters (the world's leading reusable lighter) in the U.S. and Canada. The Stoker’s® brand has a proud heritage dating to 1940. Stoker’s competes in the chewing tobacco segment, where it has grown to the #1 position, and in the moist snuff segment, where it remains one of the fastest-growing brands. The portfolio also includes Beech-Nut®, launched in 1897, and a diverse collection of other chewing tobacco brands that offer a variety of consumer choices and tastes. Our NewGen vapor portfolio includes our B2B (Vapor Beast®), B2C (International Vapor Group®) vape distribution platforms.


Electrolux Group is a leading global appliance company that has shaped living for the better for more than 100 years. We reinvent taste, care and wellbeing experiences for millions of people, always striving to be at the forefront of sustainability in society through our solutions and operations. Un

Almunajem Foods, is a Saudi Group of companies, established in 1950 by late Abdullah Ali Al Munajem, having succeeded in the food import and distribution business, other subsidiary companies that are all engaged in different activities related to food service, food industry and refrigeration. The co

DS Smith provides innovative packaging solutions, paper products and recycling services with a commitment to sustainability and a circular economy. Our core purpose is to Redefine Packaging for a Changing World, and our expert teams work closely with like-minded partners to incorporate renewable re
Philip Morris International (PMI) is a leading international consumer goods company working to deliver a smoke-free future and evolving its portfolio for the long term to include products outside of the tobacco and nicotine sector. Since 2008, PMI has invested more than USD 14 billion to develop, sc

Every day, in everything we do, our purpose is to protect, heal and nurture in the relentless pursuit of a cleaner, healthier world. And we have a fight on our hands. A fight to make access to the highest quality hygiene, wellness and nourishment a right and not a privilege. Each of our products is

Henkel operates worldwide with leading innovations, brands and technologies in two business areas: Adhesive Technologies and Consumer Brands. Founded in 1876, Henkel looks back on more than 145 years of success. The company holds leading positions with its two business units in both industrial and

Group Snef is a French leader in the field of electrical installation and, more broadly, the management of finishing turnkey projects and operations. Group Snef operates in the fields of high- and low-voltage installations, industrial processes, HVAC and maintenance. Its services cover technic
Steel Authority of India Limited (SAIL) traces its origin to the formative years of an emerging nation - India. After independence, the steel sector was to propel the economic growth and rapid industrialization of the country, and since 1973, SAIL steel has played a pivotal role in transforming the
For the builders and protectors, for the makers and explorers, for those shaping and reshaping our world through hard work and inspiration, Stanley Black & Decker provides the tools and innovative solutions you can trust to get the job done—and we have since 1843. You repair your home and car with
.png)
Turning Point Brands recently announced an expansion of its at-the-market sales agreement by US$200 million, coupled with ongoing retail...
Altria Group, Inc. (MO) is facing a pivotal moment as nicotine pouches surge to 55.7% of the U.S. oral tobacco market in the third quarter...
Lawrence Wexler, Director, on November 11, 2025, sold 46470 shares in Turning Point Brands for $4635682. Following the Form 4 filing with...
Key Points Cannell Capital increased its position in Turning Point Brands by 119821 shares, representing a value change of $13.24 million.
Turning Point Brands, Inc. ( NYSE:TPB ) just released a solid earnings report, and the stock displayed some strength...
Earnings Flash (TPB) Turning Point Brands, Inc. Reports Q3 Revenue $119.0M, vs. FactSet Est of $110.2M. Published on 11/05/2025 at 07:41 am...
LOUISVILLE, Ky., November 05, 2025--Turning Point Brands, Inc. ("TPB" or the "Company") (NYSE: TPB), a manufacturer, marketer and...
Earnings Flash (TPB) Turning Point Brands, Inc. Posts Q3 Adjusted EPS $1.27 per Share, vs. FactSet Est of $0.77.
Turning Point Brands (TPB) delivered earnings and revenue surprises of +29.63% and +5.90%, respectively, for the quarter ended September...

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of Turning Point Brands, Inc. is http://www.turningpointbrands.com.
According to Rankiteo, Turning Point Brands, Inc.’s AI-generated cybersecurity score is 748, reflecting their Moderate security posture.
According to Rankiteo, Turning Point Brands, Inc. currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, Turning Point Brands, Inc. is not certified under SOC 2 Type 1.
According to Rankiteo, Turning Point Brands, Inc. does not hold a SOC 2 Type 2 certification.
According to Rankiteo, Turning Point Brands, Inc. is not listed as GDPR compliant.
According to Rankiteo, Turning Point Brands, Inc. does not currently maintain PCI DSS compliance.
According to Rankiteo, Turning Point Brands, Inc. is not compliant with HIPAA regulations.
According to Rankiteo,Turning Point Brands, Inc. is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Turning Point Brands, Inc. operates primarily in the Manufacturing industry.
Turning Point Brands, Inc. employs approximately 234 people worldwide.
Turning Point Brands, Inc. presently has no subsidiaries across any sectors.
Turning Point Brands, Inc.’s official LinkedIn profile has approximately 5,275 followers.
Turning Point Brands, Inc. is classified under the NAICS code 30, which corresponds to Manufacturing.
Yes, Turning Point Brands, Inc. has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/turning-point-brands.
Yes, Turning Point Brands, Inc. maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/turning-point-brands-inc..
As of November 27, 2025, Rankiteo reports that Turning Point Brands, Inc. has experienced 2 cybersecurity incidents.
Turning Point Brands, Inc. has an estimated 7,594 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach and Cyber Attack.
Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with public disclosure via maine attorney general..
Title: Data Breach at International Vapor Group
Description: The California Office of the Attorney General reported a data breach involving International Vapor Group on March 12, 2019. The breach occurred on June 30, 2018, resulting in the compromise of customers' names and credit or debit card information due to unauthorized access to their e-commerce site.
Date Detected: 2019-03-12
Date Publicly Disclosed: 2019-03-12
Type: Data Breach
Attack Vector: Unauthorized Access
Title: Data Breach at Vaporfi.com and Directvapor.com
Description: The Maine Office of the Attorney General reported a data breach involving Vaporfi.com and Directvapor.com on December 21, 2020. The breach was discovered on September 23, 2020, due to unauthorized access to the online payment platform, potentially affecting 3 Maine residents and a total of 10,544 individuals, exposing credit and debit card information.
Date Detected: 2020-09-23
Date Publicly Disclosed: 2020-12-21
Type: Data Breach
Common Attack Types: The most common types of attacks the company has faced is Breach.

Data Compromised: Customers' names, Credit or debit card information
Systems Affected: E-commerce site

Data Compromised: Credit card information, Debit card information
Systems Affected: online payment platform
Identity Theft Risk: High (payment card data exposed)
Payment Information Risk: High (credit/debit card data exposed)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customers' Names, Credit Or Debit Card Information, , Payment Card Data and .

Entity Name: International Vapor Group
Entity Type: Company
Industry: E-commerce

Entity Name: Vaporfi.com
Entity Type: E-commerce
Industry: Vaping/Retail
Customers Affected: 10,544 (3 in Maine)

Entity Name: Directvapor.com
Entity Type: E-commerce
Industry: Vaping/Retail
Customers Affected: 10,544 (3 in Maine)

Communication Strategy: Public disclosure via Maine Attorney General

Type of Data Compromised: Customers' names, Credit or debit card information

Type of Data Compromised: Payment card data
Number of Records Exposed: 10,544
Sensitivity of Data: High
Data Exfiltration: Likely (unauthorized access to payment platform)
Personally Identifiable Information: Partial (payment card details)

Regulatory Notifications: Maine Attorney General

Source: California Office of the Attorney General
Date Accessed: 2019-03-12

Source: Maine Office of the Attorney General
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Office of the Attorney GeneralDate Accessed: 2019-03-12, and Source: Maine Office of the Attorney General.
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public disclosure via Maine Attorney General.

High Value Targets: Payment Card Data,
Data Sold on Dark Web: Payment Card Data,
Most Recent Incident Detected: The most recent incident detected was on 2019-03-12.
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2020-12-21.
Most Significant Data Compromised: The most significant data compromised in an incident were Customers' names, Credit or debit card information, , credit card information, debit card information and .
Most Significant System Affected: The most significant system affected in an incident was E-commerce site and online payment platform.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Customers' names, credit card information, Credit or debit card information and debit card information.
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 10.5K.
Most Recent Source: The most recent source of information about an incident are Maine Office of the Attorney General and California Office of the Attorney General.
.png)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.