‘Criminal’ data breach affects over 1,200 cannabis stores in Ontario

A massive data leak related to state-run cannabis retail stores in Ontario, Canada has sent retailers into a tailspin. However, consumer data is not part of the equation and was not disclosed during the data breach.

The Ontario Cannabis Store (OCS), a government-run agency that oversees the distribution of cannabis from licensed producers to retailers, reported that some of its sales data was “misused.”

An OCS letter sent to retailers on May 10 and quickly picked up by The Canadian Press warned that confidential sales data was being leaked across the industry.

“This data has not been disclosed by OCS, nor have we given permission or consent to disseminate or use this data outside of our organization,” reads the letter, signed by Janet Ihm, vice president of wholesale partnerships and customer care at OCS. “The data has been misappropriated, disclosed and disseminated. Therefore, we trust that you will not share or use this stolen data in any way.”

Over 1,200 Ontario retail stores are affected. Cannabis retail stores in Ontario rose to 1,333 at a recent count, up from 1,115 in September.

Three anonymous sources say store names, license numbers and dates showing whether a store is independently owned, operated by a company or operated by a franchisee have also been leaked. The matter is being investigated by the Ontario Provincial Police (OPP).

MJBizDaily confirmed to the OPP that the breach is considered “a criminal matter.” According to the authorities, the data was also unlawfully disseminated.

The data reportedly included sales information for all cannabis stores in Ontario, ranked by rank. And since the data also showed kilograms sold during the month, kilograms sold per day, total units sold and total inventory, it could put retailers at risk.

The data could end up in the wrong hands or for the wrong reasons such as: B. Competing retail stores. The data “offers a lot of really competitive insights into who’s doing what, who’s moving what, which retailers are selling what,” Deepak Anand, founder of cannabis company Materia, told The Canadian Press. “That could certainly be a head start and a step ahead of the competition within the industry that’s trying to get ahead of the next person.”

This type of incident has happened in the area before.

In 2018, OCS revealed that data from 4,500 of its customers was part of a Canada Post data breach. The 2018 breach was found to have resulted from someone accessing data through a Canada Post tracking tool. The data included names of people who bought pot shipments, OCS reference numbers, and zip codes.

Meanwhile, local residents are worried about increasing competition. Some areas are overrun with cannabis shops, such as Toronto’s Queen Street West. This eventually prompted the Toronto City Council to issue a moratorium on new cannabis store licenses. The moratorium would last for a year or until provincial legislation is introduced, allowing local communities to have a voice on the matter.

It’s concentrated areas of cannabis retail, like West Queen Street, where competition is fiercest, that appear to be more vulnerable in the face of the data leak.

Lisa Campbell, chief executive of cannabis marketing company Mercari Agency, told The Canadian Press that this could be a “death sentence” for some of the companies looking to make an acquisition.

Cannabis retail companies in Ontario already face stiff competition, so underperforming businesses could suffer if their data is exposed.