In a memo sent to cannabis businesses in the province, the OCS says an online attack was targeted at the parent company of OCS’s third-party operated distribution centre, Domain Logistics.

The “cyber attack” occurred late Friday, August 5th, leading to delays in deliveries for consumers and retailers.

Editors Note: This article initially stated the subject attack affected the OCS website. That was incorrect. The attack impacted the OCS’s third-party logistics provider for deliveries.

The attack will mean retailers will not have access to weekly deliveries, leading to product shortages and empty shelves if the delay continues, say several retailers. It will also mean delays in online orders consumers place on the OCS website.

Domain Logistics is a Toronto-based third-party logistics provider that specializes in “supply chain solutions for complex, fast-moving businesses in Canada.”

Domain Logistics oversees the facility management for the Ontario Cannabis Retail Corporation (OCR, operating at the OCS) at a leased warehouse in Guelph and for inventory control, order fulfillment for B2B sales and online customers, as well as transportation services and inspections of delivered products and returned products by the OCRC/OCS.

For B2B deliveries to retail stores, Domain Logistics subcontracts different service providers such as Pineapple Express, Rogue Transport, NLI International and NIN Transport.

An Ontario Auditor General’s report in December 2021 noted that the OCRC “did not have robust oversight over Domain Logistics. OCRC was not performing the oversight anticipated by some provisions in its service agreement with Domain Logistics and can better perform its oversight role.”

Legacy Supply Chain, the parent company of Domain Logistics posted this on their website:

“On August 5, we detected unusual activity on our network and immediately implemented our protection protocol. This included taking our network and a number of applications offline and engaging external experts to investigate and remedy the situation. Unfortunately, this is impacting our ability to conduct regular order processing for a small number of Legacy customers, and we apologize for any inconvenience. We hope to have our systems back online very soon.

“While the company maintains system connectivity with some clients to support shipping activities, the information it has access to is limited to end customers’ names and physical shipping address. The company does not have access to end customers’ personal financial data or credit card information. However, should the company’s investigation into this matter find evidence that personal or commercially sensitive data may have been illegally accessed, we will notify those affected immediately.”

In the memo, now also posted on the OCS.ca, the OCS says there is “currently no indication that OCS systems or its customers’ information was targeted or in any way compromised as a result of this attack.”

The memo continues: “However, out of an abundance of caution to protect OCS and its customers, the decision was made to shut down Domain Logistics’ operations until a full forensic investigation could be completed. Domain Logistics has engaged third-party cyber-security forensic experts to conduct the investigation and they are working closely with OCS’s cyber security experts. The investigation is well underway and expected to be completed within the coming days.”

A notice on the OCS website says “All OCS.ca orders this week will be delayed by at least 24 hours due to technical difficulties at our distribution centre.”

The memo sent to retailers also notes that this week’s scheduled launch of new products into the OCS will be delayed until further notice. The OCS will be waiving all delivery fees for retailers until September 30, 2022 and will waive the $500 processing for one “emergency order”, in a show of goodwill.

An emergency order is a non-regular delivery to a retailer if they unexpectedly run out of a product. The fee OCS charges retailers for this service is $500.

Sasha Soeterik, the owner of Flower Pot on Dundas in Toronto, says the delay in deliveries could soon lead to empty shelves for some retailers if the delay lasts longer than a week.

“The entire legal cannabis network in Ontario is about to grind to a halt.”

“I placed an order today, and it should have arrived on Thursday,” she continues. “This attack happened on Friday, but I didn’t get this notice until 9:00pm tonight (Monday).”

“I know plenty of retailers who are not going to have stock on the shelves because of this. I don’t think it could be much harder to be a retailer and be told that your one sole supplier can’t deliver to you.”

Soeterik questions why the provincial retailer and distributor don’t have a contingency plan for when such issues arise, rather than relying on one single distribution partner.

Vivianne Wilson, the owner of GreenPort Cannabis on College St. in Toronto says she had an order that was supposed to arrive today, but it never came. Because she relies on weekly shipments, she says she will soon have a severe lack of certain product types, especially pre-rolls and dried flower, which make up the majority of her sales.

“It’s a significant impact on my business and my operations,” says Wilson. “I have one pre-roll left in my case, I usually have 20-30 pre-rolls. And pre-rolls and dried flower are usually 80% of sales.”

“As an independent retailer, I don’t have the ability to keep a significant amount of inventory,” she continues, “so I’m going to lose a considerable amount of customers. I just hope that we can regain our customer base when we finally get the products, but we have no idea when this is going to be resolved.”

On August 9, the OCS posted an update on their website noting that “Domain Logistics’ and OCS’s third-party cyber-security experts have continued their assessment of all Domain Logistics’ technology systems to ensure they are free from compromise.”

The OCS says they will continue to manually accept deliveries of inventory from licensed producers, but they will only be entered into the system once Domain Logistics is operational. If required, OCS says they will reach out directly to licensed producers if adjustments need to be made on future inventory shipments.

This is not the only occasion that the OCS has faced these types of issues. In May, the OCS confirmed they had suffered a “data breach” that leaked sales data for every licensed cannabis store in the province.

The Ontario Provincial Police have opened an investigation into that data breach.

• UPDATE August 10: “The Ontario Cannabis Store’s distribution centre is in the process of returning to operational status. A small number of deliveries from the distribution centre will be made later today, beginning with the delivery of the orders that were impacted at the time of shut down.”

This article has been updated to include comments from Ontario retailers. It will continue to be updated as new details emerge.

• UPDATE August 11: Starting today, the OCS will be introducing a cap of 30 cases per store for the next order cycle. Orders will be delivered 6am – 10pm, seven days a week. They could also possibly move to a 24-hour delivery window. 

Until August 31, “as a temporary goodwill gesture”, the OCS will process payments three days after retailers receive their “Advanced Shipping Notice” that arrives prior to delivery.