The home page for the Ontario Cannabis Store is shown in this photo illustration Toronto Wednesday October 17, 2018. Canada Post publicly admitted to a privacy breach involving thousands of Ontario’s online cannabis customers on Wednesday after the province’s only outlet for legal recreational marijuana notified clients of the problem. THE CANADIAN PRESS

The home page for the Ontario Cannabis Store is shown in this photo illustration Toronto Wednesday October 17, 2018. Canada Post publicly admitted to a privacy breach involving thousands of Ontario’s online cannabis customers on Wednesday after the province’s only outlet for legal recreational marijuana notified clients of the problem. THE CANADIAN PRESS

Canada Post admits cannabis privacy breach involving 4,500 Ontario customers

Someone has used Canada Posts delivery-tracking tool to gain access to personal information of 4,500 customers

Canada Post publicly admitted to a privacy breach involving thousands of Ontario’s online cannabis customers on Wednesday after the province’s only outlet for legal recreational marijuana notified clients of the problem.

The postal service said someone had used its delivery-tracking tool to gain access to personal information of 4,500 customers of the Ontario Cannabis Store but declined to identify the data.

“Both organizations have been working closely together since that time to investigate and take immediate action,” Canada Post said in a statement. “As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”

Canada Post notified the online cannabis store on Nov. 1 about the breach, both organizations said.

RELATED: Nova Scotia fixes online workaround of age requirement for cannabis sales

In a statement on Wednesday, the Ontario Cannabis Store said it referred the matter to the province’s privacy commissioner. The statement also said the store had “encouraged” Canada Post to take immediate action to notify its customers.

“To date, Canada Post has not taken action in this regard,” the store said. ”Although Canada Post is making its own determination as to whether notification of customers is required in this instance, the OCS has notified all relevant customers.”

In response, a spokesman for Canada Post said it had explained to the cannabis outlet that it did not have contact information for the pot buyers.

According to the online store, the compromised information included postal codes and the names or initials of the person who accepted delivery of the marijuana.

Other data such as the name of the person who made the order — unless the same person signed for delivery — the actual delivery address or payment information were not affected, the statement said.

Ontario’s privacy commissioner, Brian Beamish, called the breach “unfortunate” but said it appeared the risk to customer data was limited. Beamish praised the cannabis store for notifying people about the breach and going public.

“That level of transparency is good,” Beamish said in an interview.

RELATED: Delivery of cannabis could be impacted by postal strike

Given the vulnerability occurred through Canada Post, Beamish said any further privacy action rested with the federal commissioner, who said through a spokeswoman that his office had been in contact with its provincial counterpart.

“We are also engaging with Canada Post to better understand what occurred and what is being done to mitigate the situation,” spokeswoman Tobi Cohen said.

In answer to an Opposition question Wednesday, Prime Minister Justin Trudeau told the House of Commons the breach was flagged and fixed and would not be repeated.

While marijuana ordered through the Ontario Cannabis Store is legal, privacy concerns are especially acute given the hard line taken by American authorities, who have made it clear Canadians who admit to even historical pot use could be refused entry or deemed inadmissible for life.

“I wouldn’t say I am worried (about this breach) but I am concerned any time my personal information is hacked,” said one customer, who received the email from the cannabis store. “I would prefer you not use my name only because I might like to continue to be admissible to U.S.A.”

According to the store, someone used Canada Post’s tracking tool to access delivery data, and the vulnerability also potentially affected customers of other postal clients.

“The OCS has worked closely with Canada Post to identify the cause of this issue and to prevent any further unauthorized access to customer delivery information,” the store said.

Canada Post said it was confident the individual who accessed the information only shared it with Canada Post and deleted it without distributing further.

Colin Perkel, The Canadian Press

Like us on Facebook and follow us on Twitter.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Prince Rupert City Council approved the purchase of computer chipped recycling bins on April 12. A Penticton garbage truck lifts a new bin. (Western News photo)
Big Brother to help with the garbage – computer chipped recycling bins report your bylaw infractions

They report, but will they sort — recycle bins to cost Prince Rupert $564,850

Pembina Prince Rupert Terminal celebrated the opening of operations on April 12 in a virtual online ceremony with President and CEO Mick Dilger and Manager of Communications and Media Affair Tasha Cadotte commemorating the ribbon-cutting. (Photo: Supplied)
Pembina celebrates opening of operations in Prince Rupert

A virtual ribbon-cutting ceremony commemorates LPG export facility on Watson Island

Pembina Prince Rupert Terminal shipped its first vessel full of liquefied petroleum gas on April 9, just less than three years after breaking ground at the re-purposed pulp mill site on Watson Island.
Pembina ships first vessel of LPG out of Prince Rupert

More than $12 million spent to repurpose Watson Island for the LPG export facility

Seventy-two cases of COVID-19 are reported for the week of March 28 to April 3 on the map of Graphic Distribution by Local Health Area of Case Residence for Epi-week 13. (image: BCCDC)
Cases increase to 5 in Acropolis Manor’s 2nd outbreak

Prince Rupert Regional Hospital Patient Care unit outbreak is now 4 and includes a staff member

Prince Rupert Fire Rescue attend an apartment fire on the morning of April 11 in a building at 521 Fulton Str. (Photo: K-J Millar/The Northern View)
Sunday morning fire rouses tenants

Prince Rupert Fire Rescue attended an apartment fire at 521 Fulton St.

Restaurant patrons enjoy the weather on a patio in Vancouver, B.C., Monday, April 5, 2021. The province has restricted indoor dining at all restaurants in B.C. due to a spike in COVID-19 numbers. THE CANADIAN PRESS/Jonathan Hayward
B.C.’s COVID-19 indoor dining, drinking ban extending into May

Restaurant association says patio rules to be clarified

B.C. Premier John Horgan speaks at the B.C. legislature. (B.C. government)
Tougher COVID-19 restrictions in B.C., including travel, still ‘on the table’: Horgan

John Horgan says travel restrictions will be discussed Wednesday by the provincial cabinet

Protesters occupied a road leading to Fairy Creek Watershed near Port Renfrew. (Submitted photo)
B.C. First Nation says logging activist interference not welcome at Fairy Creek

Vancouver Island’s Pacheedaht concerned about increasing polarization over forestry activities

Flow Academy is not accepting membership applications from anybody who has received a dose of the vaccine, according to a password-protected membership application form. (Submitted image)
B.C. martial arts gym refusing patrons who have been vaccinated, wear masks

Interior Health has already issued a ticket to Flow Academy for non-compliance with public health orders

Guinevere, lovingly referred to by Jackee Sullivan and her family as Gwenny, is in need of a gynecological surgery. The family is raising money to help offset the cost of the procedure. (Jackee Sullivan/Special to Langley Advance Times)
Langley lizard’s owners raise funds for gynecological surgery

The young reptile is scheduled for operation on Tuesday

Facebook screenshot of the sea lion on Holberg Road. (Greg Clarke Facebook video)
VIDEO: Sea lion randomly spotted on remote B.C. logging road

Greg Clarke was driving home on the Holberg Road April 12, when he saw a large sea lion.

Defence counsel for the accused entered two not guilty pleas by phone to Grand Forks Provincial Court Tuesday, Jan. 12. File photo
B.C. seafood company owner fined $25K for eating receipt, obstructing DFO inspection

Richmond company Tenshi Seafood is facing $75,000 in fines as decided March 4 by a provincial court judge

B.C. Finance Minister Selina Robinson speaks in the B.C. legislature, March 2, 2021. (Hansard TV)
B.C. NDP ministers defend ‘air tax,’ latest COVID-19 business aid

Empty home tax doesn’t apply to businesses, but space above them

In Ontario, COVID-19 vaccine clinics have been set up at local mosques. (Submitted photo: Rufaida Mohammed)
Getting the vaccine does not break your fast, says Muslim COVID-19 task force

Muslim community ‘strongly’ encouraging people to get their shot, whether or not during Ramadan

Most Read