Pot shop sales data was 'misappropriated,' Ontario cannabis distributor says

TheOntarioCannabisStoresays a data breach involving some of its sales information is being investigated bytheOntarioProvincial Police.

Daffyd Roderick, a spokesperson fortheCrown agency responsible for distributingcannabisfrom producers to pot shops intheprovince, confirmed what he called a misappropriation of data Tuesday evening.

"There was no failure of IT security or systems," he added.

An OCS letter obtained byTheCanadian Press and sent to retailers on May 10 said that "confidentialstoresales data" was being "circulated intheindustry."

"This data was not disclosed bytheOCS, nor have we provided any permission or consent to distribute or use this data outside of our organization," readstheletter signed by Janet Ihm,theOCS vice-president of wholesale partnerships and customer care.

"Thedata was misappropriated, disclosed, and distributed unlawfully. As a result, we trust you will refrain from sharing or using this stolen data in any way."

Inthewake ofthebreach,theOCS said it quickly launched an investigation to identifythesource, restricted access to internal data reports and notifiedthepolice, who it says will review and investigatethemisuse ofthedata.

TheOPP did not immediately confirm whether an investigation had begun.

Thefederal privacy commissioner, which all breaches must be reported to, did not respond to a request for comment.

Now 1,333 pot shops across Ontario

Theappropriation comes asthecannabisindustry is facing increasing competition and sales pressures asthenumber of pot shops inOntariohas swelled to 1,333, up from 1,115 attheend of September.

Meanwhile, most major pot producers have yet to report a profit and many have spentthelast few years slashing prices to contend withthestill popular illicit market.

TheOCS has also encountered some challenges too.

In December, Ontario's auditor general said in her annual report that manycannabisproducts are often out of stock becausetheOCS inaccurately forecasts inventory levels. Those inaccurate forecasts leave customers empty-handed and licensed producers frustrated,thereport said.

Atthetime,theOCS said that work was underway to use point-of-sale technology to automate more ofthesales reporting, which would improve inventory management and forecasting.

TheOCS has also faced a breach before. Almost four years ago,theOCS revealed information linked to about 4,500 of its customers was part of a Canada Post data breach.

TheNov. 1, 2018 breach was linked to someone accessing data, including names people who signed for pot deliveries, OCS reference numbers and postal codes, through a Canada Post tracking tool.TheOCS said those affected made up about two per cent of customer orders.