4,500 Ontario Cannabis Store users affected by data breach

Nov 8 2018, 1:52 am

The Ontario Cannabis Store (OCS) is notifying its customers of a data breach at Canada Post, which has resulted in thousands of OCS customer accounts being hacked.

In an email to customers, OCS president and CEO Patrick Ford writes that on November 1, the OCS was notified by Canada Post that “limited delivery information of approximately 2% of OCS customer orders (4,500) was accessed by an individual through the Canada Post delivery tracking tool.”

The PCS said delivery data also included information relating to customers of other Canada Post clients.

“Upon learning of this incident, the OCS immediately engaged the Office of the Information and Privacy Commissioner (IPC) of Ontario,” wrote Ford.  “Since November 1, the OCS has worked closely with Canada Post to identify the cause of this issue and to prevent any further unauthorized access to customer delivery information.”

The OCS said it has encouraged Canada Post to take “immediate action” to notify their customers.

To date, however, “Canada Post has not taken action in this regard.”

Although it said “Canada Post is making its own determination as to whether notification of customers is required in this instance,” the OCS said it has notified all relevant customers.

“Based on information obtained from Canada Post there were approximately 4,500 orders where limited delivery information was accessed,” writes Ford. “Canada Post has advised that any information obtained was deleted and not further disclosed.”

The specific delivery information was:

  • Postal code
  • Name or initials of the person who signed upon delivery
  • Date of delivery
  • OCS reference number
  • Canada Post tracking number
  • OCS corporate name and business address

For those OCS customers who did not receive an email about this breach, the OCS says it’s because “your order delivery information was not accessed.”

See also

DH Toronto StaffDH Toronto Staff

+ Grow
+ News & Policy