Canada Post said on Wednesday that a cyberattack and data breach on an electronic data interchange (EDI) supplier has compromised information from 44 of its large parcel business customers, affecting nearly 1 million recipients.
The attack on Ontario-based Commport Communications compromised the shipping manifest data of the customers. Canada Post, Canada’s government-run postal carrier, did not identify the customers.
About 950,000 recipients were impacted by the breach, Canada Post said. The vast majority of the data, 97%, consisted of names and addresses, with 3% including email addresses or phone numbers.
Canada Post said Commport notified it of the breach a week ago on May 19. The postal carrier said it is investigating the attack.
Before the latest disclosure, Canada Post said the EDI provider had notified it of a “potential ransomware issue” in November. An investigation found “no evidence to suggest any customer data had been compromised at that time,” the postal carrier said.
Canada Post did not explicitly link that “potential ransomware issue” with the newly disclosed data breach. However, it is notoriously difficult to determine the extent of data breaches after ransomware attacks, particularly in cases where the hackers cover their tracks.
Canada Post uses Commport to manage shipping manifest data of its large parcel customers.
Another Canada-based EDI provider, Faxinating Solutions, was targeted in a ransomware attack earlier in the spring.
EDIs, in place since the 1960s, offer standardized communications platforms for business-to-business communication. They are used extensively in the transportation and logistics industry to communicate key shipping data.
Commport did not immediately respond to FreightWaves’ request for comment.
Click for more FreightWaves articles by Nate Tabak.
Related coverage
Ransomware attack on EDI provider highlights cyber risks in supply chain
Colonial-level cyberattack on trucking likely – but preventable
Trailer maker Utility targeted in ransomware attack