Canada Post is admitting to a privacy breach involving thousands of Ontario's online cannabis customers.
The postal service says someone used its delivery tracking tool to gain access to personal information of 4,500 customers.
Canada Post did not say what information was compromised.
However, the Ontario Cannabis Store says the information includes postal codes, dates of delivery of cannabis and who signed for the package.
The government-run online retailer, the only legal outlet for marijuana in the province, also says Canada Post refused to notify customers about the breach.
The store has contacted customers, saying the postal service did not take any action despite repeated requests.