Canada Post hit by data breach after supplier ransomware attack

​Canada Post has informed 44 of its large commercial customers that a ransomware attack on a third-party service provider exposed shipping information for their customers.

Canada Post is the primary postal operator in Canada, serving 16.5 million Canadian residential and business addresses.

Yesterday, Canada Post disclosed that a third-party supplier named Commport Communications suffered a ransomware attack where threat actors accessed data stored in their systems.

This accessed data includes shipping manifest data for large parcel business customers, including sender and receiver contact information, names, and mailing addresses.

In total, the breach affected 44 Canada Post commercial customers and 950,000 receiving customers.

"After a detailed forensic investigation, there is no evidence that any financial information was breached. In all, the impacted shipping manifests for the 44 commercial customers contained information relating to just over 950 thousand receiving customers. After a thorough review of the shipping manifest files, we’ve determined the following:

• The information is from July 2016 to March 2019
• The vast majority (97%) contained the name and address of the receiving customer
• The remainder (3%) contained an email address and/or phone number" - Canada Post.

Lorenz ransomware responsible for the breach

In December 2020, a ransomware operation known as Lorenz posted on their data leak site that they had breached Commport Communications during a ransomware attack.

Since then, the ransomware group has leaked 35.3 GB of data allegedly stolen during the attack.

While Canada Post states that at the time of the attack, Commport did not believe that any of their data was accessed, based on the leaked data, it appears that this was not the case.

Canada Post states that they have hired external cyber security experts to assist in the investigation and have notified the Office of the Privacy Commissioner of Canada.