WestJet confirms cyberattack exposed IDs, passports in June incident

WestJet has confirmed a June cyberattack that disrupted some internal systems and its mobile app, and which exposed customer passports and IDs. The incident, described by the airline as a security breach, led to ongoing assessment of its scope with initial notices sent to affected individuals and investigations supported by experts and the FBI.

WestJet says the attack did not impact operational safety, and its response included measures to protect sensitive personal data while continuing to investigate with law enforcement and Transport Canada.

The data breach notification letter notes that the information involved varies by individual but may include name, date of birth, mailing address, information about the travel document used (such as a passport or other government-issued ID) and other travel-related details, while credit card numbers, expiry dates, CVV and account passwords were not involved. The airline is offering affected customers free 24-month identity theft protection via TransUnion, including alerts, fraud assistance and restoration help.

WestJet emphasises that some information linked to loyalty accounts or Mastercard details could also have been involved, but not the password for rewards accounts or card numbers.