“The data was misappropriated, disclosed and distributed unlawfully.”

An Ontario Cannabis Store (OCS) data breach has led to “confidential store sales data” being leaked and circulated within the industry, according to an OCS letter obtained by The Canadian Press. 

The letter, which was sent on May 10, states that the data was not disclosed by the provincial cannabis wholesaler. 

“The data was misappropriated, disclosed and distributed unlawfully,” the letter states.

“As a result, we trust you will refrain from sharing or using this stolen data in any way.”

The Ontario Provincial Police are now investigating the matter. 

MJBizDaily first reported the data breach earlier this week, noting that the information “displays the sales of every cannabis store in the province for December 2021, as well as store name, licence number, sales days, kilograms sold, kilograms sold per day, total units sold, total inventory at the beginning of the month and sell-through rate, among others.”

Per MJBiz, the leak does not contain consumer data. 

After a sluggish retail rollout, Ontario is on track to soon surpass 1,500 cannabis stores. 

Last July, as the province approached 1,000 stores, David Lobo, interim president and CEO of the OCS, warned of “market rightsizing” as a result of an increasingly competitive environment.

“This rapid growth will likely result in some retailers being faced with increased competition and a crowded marketplace, which could result in some closures,” Lobo, who was appointed to his position in March 2021, wrote in the company’s 2021 annual report. 

“Other retail stores may choose to participate in mergers and acquisitions to increase their size and scale, and presumably drive down their operating costs,” he noted in the report. 

In December 2021, the month the OCS breach focuses on, the province posted nearly $127 million in retail cannabis sales. Sales have increased since then, with the province posting $136 million in sales in January and $142 million in February, the most recent month on file from Statistics Canada.

In 2018, the OCS was involved in another data breach after someone used Canada Post’s delivery tracking tool to gain access to the personal information, including names and postal codes, of 4,500 customers.

“Both organizations have been working closely together since that time to investigate and take immediate action,” Canada Post later noted in a statement.

“As a result, important fixes have been put in place by both organizations to prevent any further unauthorized access to customer information.”

A 2020 report from Experian, a consumer credit reporting company, highlighted cannabis websites as a prime target for cyber attacks.

“Security is so under-resourced,” Ann Cavoukian, former Information and Privacy Commissioner of Ontario, told The GrowthOp in 2020.

“So when you talk about cannabis, I am sure these guys are not going to great lengths to ensure strong security. Like a lot of new startups, they focus on everything else other than security and privacy. And this will just come back to bite them,” Cavoukian cautioned at the time.