News release: Privacy Commissioner of Canada satisfied with WestJet’s enhanced security measures following cyberattack; closes investigation

Privacy Commissioner of Canada satisfied with WestJet’s enhanced security measures following cyberattack; closes investigation

Privacy Commissioner of Canada Philippe Dufresne announced today that WestJet has met the commitments that it made to his Office to strengthen its security safeguards following a cyberattack that impacted more than five million current and former customers and employees.

In 2025, the company experienced a breach when an unauthorized threat actor was able to access and exfiltrate data from the company. Following the breach, the Office of the Privacy Commissioner of Canada (OPC) launched an investigation into the matter and engaged with the company to ensure that it adequately addressed the risks to Canadians related to the breach.

In a compliance letter with the OPC that WestJet signed in July, the company confirmed that it had reinforced multi-factor authentication requirements, strengthened identity and access controls, and improved its overall security awareness. WestJet also agreed to engage an external security firm to assess the effectiveness of those new measures and to share the outcome of that assessment with the OPC, including any additional recommendations made by the firm, and inform how those recommendations would be addressed.

Now that the company has demonstrated to the OPC’s satisfaction that it has met all of its commitments, Commissioner Dufresne has closed the investigation.

“WestJet has honoured its commitment to ensure stronger protections for the personal information of its customers and employees. It has implemented the corrective measures that I had requested following the data breach and, as a result, the investigation is now closed. This case is a testament to the value of early engagement between businesses and authorities on serious incidents. Compliance letters are an important tool to address privacy issues quickly and efficiently so that Canadians’ personal information is protected.”