On Wednesday, the Ontario Cannabis Store, which sells weed online, announced a privacy breach involving 4,500 customer orders. The source of the leak: the postal service organization responsible for fulfilling these orders.
Canada Post, the country’s state-owned primary postal operator, admitted on Nov. 1 that someone used its delivery tracking tool to obtain sensitive information like postal code, date of delivery, and the name or initials of the person who signed upon delivery.
The Ontario Cannabis Store emphasized on Twitter that “no other order details were included,” such as delivery address, payment information, and the contents of the order. Canada Post also added it was confident that the individual who accessed the information “only shared it with Canada Post and deleted it without distributing further,” according to CP24. (If that doesn’t make sense to you, you’re not alone.) However, the mailing service has not explained how it can be sure only one individual had accessed the data, said the Globe and Mail.
This is the first data breach since Ontario legalized recreational cannabis on Oct. 17, a decision that allows people 19 and older to purchase cannabis online through the Ontario Cannabis Store. The store is state-owned and is the only legal option for purchasing recreational cannabis until private retailers are allowed to take off in April. The leaked information represents 2 percent of all orders placed since legalization.
Both the Ontario Cannabis Store and Canada Post have been in hot water recently for different reasons. The Ontario Cannabis Store has received more than 1,000 complaints from customers due to delayed deliveries, billing issues, and poor customer service, the Ontario Ombudsman revealed. The data breach is just another addition to the list.
The news also comes in the midst of Canada Post’s large-scale rotating strikes, a result of stalled contract negotiations. The strikes shut down the country’s largest processing center in Toronto again this week, said CTV News, leaving hundreds of packages undelivered. Interestingly, 4,500 employees joined picket lines in Toronto on Tuesday, a figure that coincides with the total number of leaked customer orders.
“Both organizations have been working closely together since that time to investigate and take immediate action,” Canada Post said in a statement. “As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”