The rollout of legal pot in Canada’s most populous province, Ontario, has been an unmitigated disaster with weeks-long delays for weed deliveries and more than 1,000 formal citizen complaints. Now, Ontario’s cannabis regime can add a breach of sensitive information to its growing list of woes.

According to a news release from the Ontario Cannabis Store (OCS), posted to Twitter on Wednesday, an individual accessed information on roughly 4,500 orders through the Canadian postal service’s delivery tracking tool, which account for about two percent of all orders placed through the online retailer.

According to a Canada Post spokesperson, the individual responsible for the breach was an OCS customer “using OCS reference numbers” to obtain other people’s information through the Canada Post website. The information accessed included the nature of the delivery—cannabis products from OCS—the name or initials of the person who signed for the delivery, their postal code, and the date of the delivery.

Specific delivery addresses, payment information, and the names of people who actually placed the orders (versus signing for them when they come to the door) were not disclosed in the breach, the OCS news release states. The retailer itself was not impacted by the intrusion but nonetheless it’s notified affected customers.