News release: WestJet commits to improving security measures following a data breach

WestJet commits to improving security measures following a data breach

In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, WestJet has committed to demonstrating that it has strengthened its security measures following a cyberattack that impacted more than five million current and former customers and employees.

The 2025 breach occurred when an unauthorized third party used social engineering tactics to bypass multi-factor authentication measures and gain access to the user account of an employee with administrative privileges. This allowed the threat actor to gain control of WestJet’s virtual servers and exfiltrate data from its cloud storage.

The compromised information varied for each individual. It included information such as names, dates of birth, e-mail and mailing addresses, phone numbers, gender, information pertaining to recent travel bookings, passport information and/or other government-issued identifiers.

In a compliance letter signed by WestJet, the company has committed to engage an external security firm to assess the effectiveness of enhanced security measures that it introduced following the breach. The company has also agreed to share any additional recommendations made by the firm with the Office of the Privacy Commissioner of Canada, and how WestJet would address those recommendations.

Compliance letters are an example of Commissioner Dufresne’s efforts to resolve privacy issues more efficiently in order to mitigate risks to Canadians more expeditiously.

The Commissioner’s investigation will remain open until he is satisfied that WestJet has fulfilled all its commitments.