The Ontario government’s online cannabis store has been in business less than a month, but it is already dealing with a major security breach of customers’ personal information.
The Ontario Cannabis Store (OCS) said a data breach through Canada Post has affected the personal information of 4,500 customers. In an update on its website, the OCS said the breach occurred on November 1 and impacts 2% of its customers. The OCS also states that the private customer information was accessed by a person using a Canada Post tracking tool.
The OCS said it has informed Ontario's privacy commissioner of the breach and is in the process of contacting all affected customers. Ontario Privacy Commissioner Brian Beamish called the breach “unfortunate.”
"Since November 1, the OCS has worked closely with Canada Post to identify the cause of this issue and to prevent any further unauthorized access to customer delivery information," the OCS said in a statement posted to its website.
Names of the people who made the orders were not obtained, if they were not the same as the people who signed for delivery, according to the OCS. Information that was compromised includes customer names, initials, postal codes, date of cannabis delivery, OCS reference numbers, Canada Post tracking numbers and OCS corporate names and business addresses.
Customers affected by the breach were notified by the OCS via email, it added. If customers who have placed orders with the OCS did not receive an email notifying them of the breach, then their order delivery information was not obtained, said the company.
Customers with questions are urged to call the OCS's customer service line at 1-888-910-0627.
