The home page for the Ontario Cannabis Store is shown in this photo illustration Toronto Wednesday October 17, 2018. Canada Post publicly admitted to a privacy breach involving thousands of Ontario’s online cannabis customers on Wednesday after the province’s only outlet for legal recreational marijuana notified clients of the problem. THE CANADIAN PRESS

The home page for the Ontario Cannabis Store is shown in this photo illustration Toronto Wednesday October 17, 2018. Canada Post publicly admitted to a privacy breach involving thousands of Ontario’s online cannabis customers on Wednesday after the province’s only outlet for legal recreational marijuana notified clients of the problem. THE CANADIAN PRESS

Canada Post admits cannabis privacy breach involving 4,500 Ontario customers

Someone has used Canada Posts delivery-tracking tool to gain access to personal information of 4,500 customers

Canada Post publicly admitted to a privacy breach involving thousands of Ontario’s online cannabis customers on Wednesday after the province’s only outlet for legal recreational marijuana notified clients of the problem.

The postal service said someone had used its delivery-tracking tool to gain access to personal information of 4,500 customers of the Ontario Cannabis Store but declined to identify the data.

“Both organizations have been working closely together since that time to investigate and take immediate action,” Canada Post said in a statement. “As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”

Canada Post notified the online cannabis store on Nov. 1 about the breach, both organizations said.

RELATED: Nova Scotia fixes online workaround of age requirement for cannabis sales

In a statement on Wednesday, the Ontario Cannabis Store said it referred the matter to the province’s privacy commissioner. The statement also said the store had “encouraged” Canada Post to take immediate action to notify its customers.

“To date, Canada Post has not taken action in this regard,” the store said. ”Although Canada Post is making its own determination as to whether notification of customers is required in this instance, the OCS has notified all relevant customers.”

In response, a spokesman for Canada Post said it had explained to the cannabis outlet that it did not have contact information for the pot buyers.

According to the online store, the compromised information included postal codes and the names or initials of the person who accepted delivery of the marijuana.

Other data such as the name of the person who made the order — unless the same person signed for delivery — the actual delivery address or payment information were not affected, the statement said.

Ontario’s privacy commissioner, Brian Beamish, called the breach “unfortunate” but said it appeared the risk to customer data was limited. Beamish praised the cannabis store for notifying people about the breach and going public.

“That level of transparency is good,” Beamish said in an interview.

RELATED: Delivery of cannabis could be impacted by postal strike

Given the vulnerability occurred through Canada Post, Beamish said any further privacy action rested with the federal commissioner, who said through a spokeswoman that his office had been in contact with its provincial counterpart.

“We are also engaging with Canada Post to better understand what occurred and what is being done to mitigate the situation,” spokeswoman Tobi Cohen said.

In answer to an Opposition question Wednesday, Prime Minister Justin Trudeau told the House of Commons the breach was flagged and fixed and would not be repeated.

While marijuana ordered through the Ontario Cannabis Store is legal, privacy concerns are especially acute given the hard line taken by American authorities, who have made it clear Canadians who admit to even historical pot use could be refused entry or deemed inadmissible for life.

“I wouldn’t say I am worried (about this breach) but I am concerned any time my personal information is hacked,” said one customer, who received the email from the cannabis store. “I would prefer you not use my name only because I might like to continue to be admissible to U.S.A.”

According to the store, someone used Canada Post’s tracking tool to access delivery data, and the vulnerability also potentially affected customers of other postal clients.

“The OCS has worked closely with Canada Post to identify the cause of this issue and to prevent any further unauthorized access to customer delivery information,” the store said.

Canada Post said it was confident the individual who accessed the information only shared it with Canada Post and deleted it without distributing further.

Colin Perkel, The Canadian Press

Like us on Facebook and follow us on Twitter.

Just Posted

(File photo from The Canadian Press)
Red Deer down to 66 active COVID-19 cases

Red Deer has lowest number of active cases since last November

Orange shirts, shoes, flowers and messages are displayed on the steps outside the legislature in Victoria, B.C., on Tuesday, June 8, 2021 following a ceremony hosted by the Songhees and Esquimalt First Nations in honour of the 215 residential school children whose remains have been discovered buried near the facility in Kamloops, B.C. THE CANADIAN PRESS/Chad Hipolito
Alberta city cancels Canada Day fireworks at site of former residential school

City of St. Albert says that the are where the display was planned, is the site of the former Youville Residential School

FILE – Perry Bellegarde, National Chief of the Assembly of First Nations, takes part in an event on Parliament Hill in Ottawa on Tuesday, July 7, 2020. THE CANADIAN PRESS/Sean Kilpatrick
Indigenous Peoples Day must be a ‘call to action’, says Assembly of First Nations chief

Discovery of children at Kamloops residential school site must lead to change, Perry Bellegarde says

The Government of Alberta identified 115 new COVID-19 cases Sunday, bringing the provincial total to 3,089.
(Black Press file photo)
Alberta reports 100 new cases of COVID-19

The Central zone sits at 218 active cases

The Government of Alberta identified 115 new COVID-19 cases Sunday, bringing the provincial total to 3,089.
(Black Press file photo)
Red Deer drops to 71 active cases of COVID-19

Province adds 127 new cases of the virus

The border crossing into the United States is seen during the COVID-19 pandemic in Lacolle, Que. on February 12, 2021. THE CANADIAN PRESS/Paul Chiasson
VIDEO: Border quarantine to soon lift for fully vaccinated Canadians

Eligible travellers must still take multiple COVID-19 tests

FILE - In this Nov. 29, 2020, file photo, Las Vegas Raiders defensive end Carl Nassib leaves the field after an NFL football game against the Atlanta Falcons in Atlanta. Nassib on Monday, June 21, 2021, became the first active NFL player to come out as gay. Nassib announced the news on Instagram, saying he was not doing it for the attention but because “I just think that representation and visibility are so important.” (AP Photo/John Bazemore, File)
Nassib becomes first active NFL player to come out as gay

More than a dozen NFL players have come out as gay after their careers were over

A pair of Alberta residents were arrested after police responded to a report of a woman who had allegedly been assaulted and confined against her will on June 20, 2021. (File photo)
Salmon Arm RCMP arrest 2 Albertans suspected in alleged assault, unlawful confinement

Firearms, stolen items seized including NHL hockey cards believed to be worth thousands

A man makes his way past signage to a mass COVID-19 vaccination centre at the University of Toronto’s Mississauga campus during the COVID-19 pandemic in Mississauga, Ont., on Monday, May 17, 2021. THE CANADIAN PRESS/Nathan Denette
Canadians encouraged to see mRNA shots as interchangeable as more 2nd doses open up

Doctors urge people not to hesitate if offered Moderna after getting Pfizer for their first shot

Chief of Defence Staff Jonathan Vance sits in the front row during a news conference in Ottawa on June 26, 2020. THE CANADIAN PRESS/Adrian Wyld
Defence committee rises without report on Vance allegations

Committee had been investigating the government’s handling of complaints against former defence chief

Tl’etinqox-lead ceremony at the site of the former St. Joseph’s Mission in Williams Lake, B.C., June 18, 2021. (Angie Mindus photo - Williams Lake Tribune)
‘We are all one people’: Honouring residential school victims and survivors

Love, support and curiousity: Canadians urged to learn about residential schools and their impact

Indigenous rights and climate activists gathered outside Liberty Mutual’s office in Vancouver to pressure the insurance giant to stop covering Trans Mountain. (Photo by Andrew Larigakis)
Activists work to ensure Trans Mountain won’t get insurance

Global campaign urging insurance providers to stay away from Canadian pipeline project

Investigators use a bucket to help recover human remains at a home burned in the Camp fire, Thursday, Nov. 15, 2018, in Magalia, Calif. Many of the missing in the deadly Northern California wildfire are elderly residents in Magalia, a forested town of about 11,000 north of the destroyed town of Paradise. (AP Photo/John Locher)
‘Forever War’ with fire has California battling forests instead

Five of the state’s largest-ever blazes seared California last year, as authorities tackle prevention

Tokyo 2020 President Seiko Hashimoto and IOC President Thomas Bach, on a screen, speak during a five=party online meeting at Harumi Island Triton Square Tower Y in Tokyo Monday, June 21, 2021. The Tokyo Olympics will allow some local fans to attend when the games open in just over a month, Tokyo organizing committee officials and the IOC said on Monday. (Rodrigo Reyes Marin/Pool Photo via AP)
Tokyo Olympics to allow Japanese fans only, with strict limits

Organizers set a limit of 50% capacity — up to a maximum of 10,000 fans

Most Read