Canada Post now admits there has been a privacy breach.
The postal service says someone used its delivery tracking tool to gain access to personal information of 4,500 online cannabis customers.
Canada Post did not say what information was compromised, however, the Ontario Cannabis Store says the information includes postal codes, dates of delivery of cannabis and who signed for the package.
In a statement, Canada Post says the information was collected through a weakness in its website and that "important fixes" have been completed, but doesn't get into exactly what's been done.
The government-run online retailer, the only legal outlet for marijuana in the province, also says Canada Post refused to notify customers about the breach.
The store has contacted customers, saying the postal service did not take any action despite repeated requests.
— with files from The Canadian Press and Newstalk 1010