Ontario Government Reports Major Data Breach of Cannabis Companies
Hackers have leaked data from a major cannabis company managed by the Ontario provincial government. The leaked information includes a full report for December 2021, detailing how much cannabis each store had in stock, their sales figures, sales ratios, business partners, and more.
The Ontario Cannabis Store (OCS), a government corporation with a monopoly on wholesale cannabis supply to retail stores, announced that police are investigating the incident involving the leak of confidential business data.
“The data was illegally obtained, disclosed, and distributed,” said an OCS spokesperson in an email sent to journalists. “We hope you will refrain from spreading or using this stolen data.” The spokesperson also noted that the incident is being treated as a criminal matter.
Currently, Ontario police are conducting their own analysis and investigation into the misuse of this data within the cannabis industry. OCS claims the breach was not due to a failure in their IT systems or organizational security, but rather that the data was “illegally obtained” by someone.
What Data Was Leaked
The leaked data reflects sales from all cannabis stores in Ontario for December 2021. Among other details, the data includes store numbers, license numbers, sales days, kilograms sold, daily sales figures, total units sold, inventory at the start of the month, and sales ratios. The leak also shows which stores operate independently and which are part of the government corporation or franchises.
It is specified that consumer data was not included in the breach.
Potential Consequences of the Breach
Industry representatives say the leak could significantly change how market players behave—from their expansion or store sale plans to their relationships with licensed producers.
“Anyone who has seen this now has an unfair competitive advantage, knowing how much the neighboring [store] earns,” said a cannabis shop owner who requested anonymity. “And if I don’t have this data and am operating blindly, like most retailers, I can’t make profitable business decisions.”
According to him, the leak could also lead to public safety issues—if a store is making good money, it automatically becomes a potential target for robbers. On the other hand, the leak has revealed the real state of the Canadian cannabis industry—there are still not many successful stores in Ontario.
Legal Immunity
The shop owner is most concerned that this time, OCS will likely avoid responsibility.
“What happens when OCS violates its own agreement? There are no legal remedies here,” he said. “The victims are the retailers whose confidential data becomes public. But if I violated my own agreement with OCS, I would no longer be allowed to sell cannabis.”
Not the First Time
This is not the first time OCS has experienced a data breach. The previous incident occurred about four years ago, when unknown individuals obtained data on 4,500 customers (about 2% of all customers) who had ordered delivery. That leak included both names and postal codes.
Our other channels and partners:
- Our friends and partners