The rollout of legal pot in Canadas most populous province, Ontario, has been an unmitigated disaster with weeks-long delays for weed deliveries and more than 1,000 formal citizen complaints. Now, Ontarios cannabis regime can add a breach of sensitive information to its growing list of woes.
According to a news release from the Ontario Cannabis Store (OCS), posted to Twitter on Wednesday, an individual accessed information on roughly 4,500 orders through the Canadian postal services delivery tracking tool, which account for about two percent of all orders placed through the online retailer.
3 Weeks In, Canada Has a Legal Pot Problem
According to a Canada Post spokesperson, the individual responsible for the breach was an OCS customer using OCS reference numbers to obtain other peoples information through the Canada Post website. The information accessed included the nature of the delivery—cannabis products from OCS—the name or initials of the person who signed for the delivery, their postal code, and the date of the delivery.
Specific delivery addresses, payment information, and the names of people who actually placed the orders (versus signing for them when they come to the door) were not disclosed in the breach, the OCS news release states. The retailer itself was not impacted by the intrusion but nonetheless its notified affected customers.
Canada Post—which has been administering nationwide rotating strikes for weeks due to stalled contract negotiations—notified the retailer of the breach on November 1, two weeks after recreational cannabis use was legalized in Canada. According to a Canada Post spokesperson, the OCS customer who accessed the sensitive information shared it with Canada Post and it has since been destroyed.
Video: Ontario Cannabis Store data breach affects thousands
Both [Canada Post and OCS] have been working closely together since that time to investigate and take immediate action, a Canada Post spokesperson wrote Motherboard in an emailed statement. As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information. We have also shared with OCS that we are confident that the customer who accessed the information only shared it with Canada Post and deleted it without distributing further.”
With a privacy breach now added to the mix, Ontarios system for legal cannabis is looking messier than it already did. And thats saying something.
Canada Post is admitting to a privacy breach involving thousands of Ontario's online cannabis customers.
The postal service says someone used its delivery tracking tool to gain access to personal information of 4,500 customers.
However, the Ontario Cannabis Store says the information includes postal codes, dates of delivery of cannabis and who signed for the package.
The government-run online retailer, the only legal outlet for marijuana in the province, also says Canada Post refused to notify customers about the breach.
The store has contacted customers, saying the postal service did not take any action despite repeated requests.