News release
WestJet commits to improving security measures following a data breach
July 14, 2026 – Gatineau, Quebec
In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, WestJet has committed to demonstrating that it has strengthened its security measures following a cyberattack that impacted more than five million current and former customers and employees.
The 2025 breach occurred when an unauthorized third party used social engineering tactics to bypass multi-factor authentication measures and gain access to the user account of an employee with administrative privileges. This allowed the threat actor to gain control of WestJet’s virtual servers and exfiltrate data from its cloud storage.
The compromised information varied for each individual. It included information such as names, dates of birth, e-mail and mailing addresses, phone numbers, gender, information pertaining to recent travel bookings, passport information and/or other government-issued identifiers.
In a compliance letter signed by WestJet, the company has committed to engage an external security firm to assess the effectiveness of enhanced security measures that it introduced following the breach. The company has also agreed to share any additional recommendations made by the firm with the Office of the Privacy Commissioner of Canada, and how WestJet would address those recommendations.
Compliance letters are an example of Commissioner Dufresne’s efforts to resolve privacy issues more efficiently in order to mitigate risks to Canadians more expeditiously.
The Commissioner’s investigation will remain open until he is satisfied that WestJet has fulfilled all its commitments.
Quote
“I welcome WestJet’s commitment to ensuring stronger protections for the personal information of its customers and employees by reinforcing multi-factor authentication requirements, strengthening identity and access controls, and improving its overall security awareness. Prioritizing privacy helps organizations to build trust. Organizations that invest in strong data governance differentiate themselves as trustworthy stewards of personal information. This is crucial as cyber security threats continue to evolve.”
Philippe Dufresne
Privacy Commissioner of Canada
Related link
Media contact
Office of the Privacy Commissioner of Canada
communications@priv.gc.ca
- Date modified: