The names, shipping addresses, and order dates of more than 4,500 Ontario Cannabis Store (OCS) customers were exposed after an unauthorized individual accessed the database of the Canada Post postal service on November 1. The next day, the CEO of the Ontario Cannabis Retail Corporation sent a letter to the head of Canada Post demanding the government agency inform the affected customers. But word about the privacy breach only went out to customers on Wednesday, six days later. Now, Canadian officials are saying that the vulnerability that led to the November 1 data breach is a system-wide issue affecting Canada Post’s entire delivery tracking system.
Privacy Breach Exposes 4,500 Cannabis Customers’ Purchase Data
On October 17, Canada became just the second country in the world to legalize cannabis for adult use. But a patchwork of provincial regulations has led to the uneven implementation of legal retail industries. In Ontario, for example, retail storefronts are on hold until next year. For now, the only legal way to purchase cannabis is through the Ontario Cannabis Store‘s online portal. The task of delivering cannabis products to customers falls to the Canada Post.
But Canada Post’s own online package tracking system has a massive