Article content continued

“To date, Canada Post has not taken action in this regard,” the store said in its statement. “Although Canada Post is making its own determination as to whether notification of customers is required in this instance, the OCS has notified all relevant customers.”

Photo by Darryl Dyck/The Canadian Press

In response, a spokesman for Canada Post said it had explained to the cannabis store that it did not have contact information for the pot buyers.

According to the online store, the compromised information included postal codes and the names or initials of the person who accepted delivery of the marijuana.

No other order details were included, such as the name of the person who made the order — unless it was the same as the individual who signed for delivery — or the actual delivery address or payment information, the statement said.

OCS said customers who did not receive an email notification were not part of the breach.

Ontario’s privacy commissioner, Brian Beamish, called the breach “unfortunate” but said it appeared the risk to customer data was limited.

“I’m certainly pleased that OCS took the step of notifying people of the breach and making it public,” Beamish said in an interview. “That level of transparency is good.”