Skip to main content
The Globe and Mail
Support Quality Journalism.
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
per week
for first 24 weeks

Enjoy unlimited digital access
Cancel Anytime
Enjoy Unlimited Digital Access
Get full access to
Just $1.99per week for the first 24weeks
Just $1.99per week for the first 24weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(}function setPanelState(o){dom.root.classList[o?"add":"remove"](,dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); } //

Part of Cannabis and consumers

Canada Post acknowledged Wednesday that thousands of Ontario customers buying cannabis had their information breached.

The national mail service has not notified the buyers behind 4,500 orders who had their data compromised. The breach became public after the Ontario Cannabis Store issued a statement on Wednesday and e-mailed affected customers the same day.

Ontario’s only legal outlet for recreational cannabis said it was notified last Thursday by Canada Post that someone had gained access to information such as postal codes and the names or initials of the adult who signed for the delivery of the marijuana. Other data such as the name of the person who made the order – unless the same person signed for delivery – the full delivery address or payment information were not affected, the OCS statement said.

Story continues below advertisement

The cannabis agency said it immediately referred the issue to the provincial Privacy Commissioner and “encouraged” Canada Post to take quick action to notify its customers.

“To date, Canada Post has not taken action in this regard,” the store said. “Although Canada Post is making its own determination as to whether notification of customers is required in this instance, the OCS has notified all relevant customers.”

The home page for the Ontario Cannabis Store is shown in this photo illustration on Oct. 17, 2018. Canada Post publicly admitted on Nov. 7, 2018, to a privacy breach involving thousands of Ontario's online cannabis customers after the province's only outlet for legal recreational marijuana notified clients of the problem.

The Canadian Press

Canada Post said in a statement on Wednesday that it told the OCS it could not notify the customers affected by the breach because it did not have their contact information. The OCS said the orders accessed represented about 2 per cent of all licensed transactions completed in the province since the drug was legalized three weeks ago.

Canada Post said five companies had their names exposed in the breach, but would not clarify whether those five companies were customers of the cannabis store or were doing other business with the federal Crown corporation. Shopify, which handles the e-commerce platform for Ontario and other provincial cannabis outlets, said it was not involved in the incident.

Canada Post said it learned of the breach after an OCS customer contacted the postal service saying he had been able to access the information of other people’s orders and urged Canada Post to review the situation.

The Crown corporation said it was confident the individual who accessed the information only shared it with the company and deleted it without distributing further. But Canada Post could not explain how they verified that only one person had accessed the data.

A spokesman for Canada Post would not say when the individual let the postal service know he had accessed the information. In a statement, Canada Post said it had been working with the OCS since last Thursday and has now fixed the problem.

Story continues below advertisement

“Both organizations have been working closely together since that time to investigate and take immediate action,” Canada Post said in a statement. “As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”

Ontario’s Privacy Commissioner, Brian Beamish, called the breach “unfortunate” but said it appeared the risk to customer data was limited. Mr. Beamish praised the cannabis store for notifying people about the breach and going public.

“That level of transparency is good,” Mr. Beamish said in an interview.

Given the vulnerability occurred through Canada Post, Mr. Beamish said any further privacy action rested with the federal Privacy Commissioner. A spokesperson said the federal commissioner’s office had been in contact with its provincial counterpart.

"We are also engaging with Canada Post to better understand what occurred and what is being done to mitigate the situation," spokeswoman Tobi Cohen said.

In answer to an opposition question on Wednesday, Prime Minister Justin Trudeau told the House of Commons the breach was fixed and would not be repeated.

Story continues below advertisement

Ronak Shah, a Toronto-based lawyer who specializes in privacy law, said this incident underscores how two organizations interpret their different obligations to customers under the separate provincial and federal privacy laws. In this instance, he said, it appears Canada Post took the position that it was a vendor to the OCS and, thus, the responsibility to notify the affected customers lay with the provincial outlet.

With a report from The Canadian Press

Your Globe

Build your personal news feed

  1. Follow topics and authors relevant to your reading interests.
  2. Check your Following feed daily, and never miss an article. Access your Following feed from your account menu at the top right corner of every page.

Follow the author of this article:

View more suggestions in Following Read more about following topics and authors
Report an error Editorial code of conduct
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to If you want to write a letter to the editor, please forward to

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

If you do not see your comment posted immediately, it is being reviewed by the moderation team and may appear shortly, generally within an hour.

We aim to have all comments reviewed in a timely manner.

Comments that violate our community guidelines will not be posted.

UPDATED: Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies