News release

Privacy Commissioner of Canada to investigate cybersecurity breach at WestJet

August 5, 2025 – Gatineau, Quebec

Privacy Commissioner of Canada Philippe Dufresne has opened an investigation into a breach at WestJet following a cybersecurity incident involving a malicious actor who was able to gain access to the airline’s systems. WestJet first issued a public advisory about the incident on June 13.

The investigation will examine the security safeguards that WestJet had in place at the time of the breach as well as the adequacy of its notifications to affected individuals to determine the airline’s compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.

The Office of the Privacy Commissioner of Canada (OPC) is actively engaging with the organization to ensure that it is taking appropriate steps to respond to the incident, and the immediate focus is on ensuring that the company is effectively addressing the breach and protecting the personal information of its customers. This includes breach containment, notification of those affected and measures to reduce risks.

As the matter involves an active investigation, the OPC is not in a position to provide further details at this time.

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca