WestJet revealed that a cyberattack occurred in June, compromising some passengers’ personal information. However, the airline reassured that the breach did not typically involve sensitive data. The incident, which took place on June 13, was attributed to a sophisticated criminal third party.
The company confirmed that its internal security measures successfully thwarted the attackers from accessing customers’ financial details like credit card numbers, expiry dates, and CVV numbers. No user passwords were compromised. Nonetheless, certain passengers had their personal details exposed, including their names, contact information, reservation-related data, and information on their interactions with WestJet.
WestJet stated that containment of the breach has been completed, and additional system and data security enhancements have been put in place. Ongoing analysis is being conducted, with a commitment to continually strengthen cybersecurity protocols.
Efforts are underway to reach out to affected customers for support, and comprehensive guidance has been provided on WestJet’s website. The airline has engaged Cyberscout to offer fraud assistance and remediation services to impacted individuals. Collaboration with law enforcement agencies such as the U.S. Federal Bureau of Investigation and the Canadian Centre for Cyber Security is ongoing.
WestJet has informed relevant authorities, including U.S. credit reporting agencies like TransUnion, Experian, and Equifax, attorneys general from multiple U.S. states, Transport Canada, the Office of the Privacy Commissioner of Canada, and corresponding provincial and international entities.
