Personal Data Stolen From Ontario Cannabis Customers

[dropcap class=”kp-dropcap”]T[/dropcap]he Ontario Cannabis Store (OCS) reported that a data breach through Canada Post recently compromised information from 4,500 cannabis customers.

In a privacy update on its website, the OCS said the breach happened late on Nov. 1 and affected about two percent of customers’ orders. The information was accessed by someone using a Canada Post delivery tracking tool, and the OCS said it informed all affected customers of the breach, as well as Brian Beamish, Ontario’s privacy commissioner. The OCS said the breach also potentially affected customers of other Canada Post clients. “I’m certainly pleased that OCS took the step of notifying people of the breach and making it public,” Beamish said in an interview. “That level of transparency is good.”

Information that was disclosed included postal codes, names or initials of people who signed upon delivery, date of delivery, OCS reference numbers, Canada Post tracking numbers and OCS corporate names and business addresses. The OCS said customers who did not receive an email notification were unaffected by the breach.

Legal cannabis in Canada was expected to run into some problems as experts had already predicted Canada would run out of recreational cannabis, but the privacy breach builds on previous concerns by the public. After the U.S. said Canadians who admit to consuming cannabis could be refused entry into the U.S., some of the affected customers are worried about how the breach will affect future travel plans.

“I wouldn’t say I am worried [about this breach] but I am concerned any time my personal information is hacked,” said one customer, who received the email from the cannabis store. “I would prefer you not use my name only because I might like to continue to be admissible to U.S.A.”

In a statement last week, Canada Post admitted to the breach and said it was working with the OCS to prevent any future breaches from happening. Canada Post said it was confident the information accessed was only shared with Canada Post and was deleted without being distributed further.