Ontario Cannabis Store customers hit by data breach
The Ontario Cannabis Store (OCS) has confirmed that 4,500 customers have had their data compromised following a security breach at Canada Post.
Around 2% of the recreational cannabis retailer’s customers were affected by the incident on November 1, the company confirmed.
The incident was sparked by a vulnerability in the Canada Post delivery tracking tool.
An unknown actor was able to access personal details via the tool including post codes, name or initials of the person who signed for the package, tracking numbers, and the OCS business address.
The customer’s name was not accessed unless they signed for the package, neither was their delivery address or payment details.
OCS said it immediately notified both Ontario’s privacy commissioner and the affected customers, who were emailed shortly after the incident.
Patrick Ford, president and CEO of OCS, said in a statement: “The OCS takes privacy and security very seriously. Protecting customer information has been the number one priority since the development of OCS.ca.”
Joint effort
Canada Post commented: “Both organizations have been working closely together since that time to investigate and take immediate action.
“As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”
The breach comes just weeks after Canada passed a new law making it legal to use marijuana recreationally.
On October 17, the federal Cannabis Act made Canada the second country in the world, after Uruguay, to allow casual use of the drug.