TORONTO — The Ontario Cannabis Store says a data breach involving some of its sales information is being investigated by the Ontario Provincial Police.
Daffyd Roderick, a spokesperson for the Crown agency responsible for distributing cannabis from producers to pot shops in the province, confirmed what he called a misappropriation of data Tuesday evening.
“There was no failure of IT security or systems,” he added.
An OCS letter obtained by The Canadian Press and sent to retailers on May 10 said that “confidential store sales data” was being “circulated in the industry.”
“This data was not disclosed by the OCS, nor have we provided any permission or consent to distribute or use this data outside of our organization,” reads the letter signed by Janet Ihm, the OCS vice-president of wholesale partnerships and customer care.
“The data was misappropriated, disclosed, and distributed unlawfully. As a result, we trust you will refrain from sharing or using this stolen data in any way.”
In the wake of the breach, the OCS said it quickly launched an investigation to identify the source, restricted access to internal data reports and notified the police, who it says will review and investigate the misuse of the data.
The OPP did not immediately confirm whether an investigation had begun.
The federal privacy commissioner, which all breaches must be reported to, did not respond to a request for comment.
The appropriation comes as the cannabis industry is facing increasing competition and sales pressures as the number of pot shops in Ontario has swelled to 1,333, up from 1,115 at the end of September.
Meanwhile, most major pot producers have yet to report a profit and many have spent the last few years slashing prices to contend with the still popular illicit market.
The OCS has also encountered some challenges too.
In December, Ontario’s auditor general said in her annual report that many cannabis products are often out of stock because the OCS inaccurately forecasts inventory levels. Those inaccurate forecasts leave customers empty-handed and licensed producers frustrated, the report said.
At the time, the OCS said that work was underway to use point-of-sale technology to automate more of the sales reporting, which would improve inventory management and forecasting.
The OCS has also faced a breach before. Almost four years ago, the OCS revealed information linked to about 4,500 of its customers was part of a Canada Post data breach.
The Nov. 1, 2018 breach was linked to someone accessing data, including names people who signed for pot deliveries, OCS reference numbers and postal codes, through a Canada Post tracking tool. The OCS said those affected made up about two per cent of customer orders.
This report by The Canadian Press was first published March 10, 2022.
