‘Limited delivery info’ of 4500 Ontario Cannabis Store customers breached: Canada Post

Canada Post says “limited delivery information” of about 4500 customers of the online Ontario Cannabis Store was accessed through the postal service’s website.

In a statement to CTV News, Canada Post says they notified the Ontario Cannabis Store (OCS) on November 1 that “limited delivery information from approximately 4,500 customer orders had been accessed by an individual OCS customer through our website using OCS reference numbers.”

Canada Post says both agencies have been working to close the online gaps and “important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”

The OCS has notified its customers about the breach.

It says the following information was accessed:

  • Name or initials of the person who signed upon delivery
  • Postal Code
  • Date of delivery
  • OCS reference number
  • Canada Post tracking number
  • OCS corporate name and business address

The OCS stressed no other details were included in the breach. The name of the person who made the order (if not the same as the one who signed), the delivery address, any payment information, and the content of the order were not accessed.

It’s not believed the information was shared or distributed. Canada Post says, “We have also shared with OCS that we are confident that the customer who accessed the information only shared it with Canada Post and deleted it without distributing further.”

Still, the crown corporation says it has notified the federal and provincial privacy commissioners about the breach.

Legal recreational cannabis can only be purchased in Ontario through the OCS website. The provincially-run retailer says it accepted more than 100,000 online orders in its first 24 hours after cannabis was legalized October 17.

With files from CTV Ottawa’s Stefan Keyes.