‘Criminal’ Data Breach Affects Over 1,200 Cannabis Stores in Ontario

A massive leak of data associated with government-run cannabis retail stores in Ontario, Canada put retailers in a tailspin. Consumer data, however, is not part of the equation, and wasn’t exposed during the data breach.

The Ontario Cannabis Store (OCS), a government-run agency overseeing the distribution of cannabis from licensed producers to retailers, reported that some of its sales data was “misappropriated.”

An OCS letter sent to retailers on May 10 and quickly picked up by The Canadian Press warned that confidential sales data was being circulated throughout the industry.

“This data was not disclosed by the OCS, nor have we provided any permission or consent to distribute or use this data outside of our organization,” reads the letter, signed by Janet Ihm, vice-president of wholesale partnerships and customer care at OCS. “The data was misappropriated, disclosed, and distributed unlawfully. As a result, we trust you will refrain from sharing or using this stolen data in any way.”

Over 1,200 retail stores in Ontario have been affected. Retail cannabis stores in Ontario rose to 1,333 by a recent count, up from 1,115 in September.

Three anonymous sources say that store names, license numbers, and data showing whether a store is independently owned, run by a corporation, or by a franchisee was also leaked. The matter is being investigated by the Ontario Provincial Police (OPP).

MJBizDaily confirmed with the OPP that the breach is being considered “a criminal matter.” The data was also distributed unlawfully, according to authorities.

Reportedly the data contained ranked sales info of every cannabis store in Ontario. And given that the data also showed kilograms sold during the month, kilograms sold per day, total units sold, total inventory—it could put retailers at risk.

The data could end up in the wrong hands or for the wrong reasons, such as rival retail stores. The data “provides a lot of really competitive insight into who’s doing what, who’s moving what, which retailers are selling what,” Deepak Anand, founder of cannabis company Materia, told The Canadian Press. “That certainly could be a leg up and give a leg up to competition within the industry that’s looking to get ahead of the next person.”

This type of incident has happened before in the area.

In 2018, the OCS revealed that data for 4,500 of its customers was part of a Canada Post data breach. The 2018 breach was found to be the result of someone accessing data via a Canada Post tracking tool. The data included names of people who purchased pot deliveries, OCS reference numbers as well as postal codes.

Meanwhile, residents are concerned about the rise in competition. Some areas are overrun with cannabis stores, such as Toronto’s Queen Street West. That eventually led the Toronto City Council to issue a moratorium on new cannabis store licenses. The moratorium would run for a year or until a provincial bill is put forth, allowing local communities to have a voice in the matter.

It’s concentrated areas of cannabis retail like Queen Street West, where competition is the most fierce, that would appear to be more vulnerable amid the data leak.

Lisa Campbell, chief executive at cannabis marketing company Mercari Agency, told The Canadian Press that it could be a “death sentence” for some of the businesses who are seeking to be acquired.

Cannabis retail businesses in Ontario face stiff competition already, so underperforming stores could suffer if their data is revealed.