Canadian airline WestJet has officially confirmed that the cyberattack disclosed in June exposed highly sensitive passenger data, including passports, government IDs, and personal details.
WestJet, one of North America’s largest airlines with a fleet of 153 aircrafts and more than 25 million annual passengers, first reported the incident on June 13, when internal systems and the company’s app were disrupted. At the time, details about exposed data were unclear.
What We Know Now
According to WestJet’s recent notification (shared with U.S. authorities and impacted customers), attackers gained access to:
- Full name, date of birth, and mailing address
- Travel documents (passport or government-issued ID)
- Accommodation requests and filed complaints
- WestJet Rewards Member ID, points, and related details
- Information related to WestJet RBC Mastercard accounts
⚠️ No debit/credit card numbers, CVVs, expiry dates, or passwords were exposed.
However, passengers are being urged to notify anyone who may have traveled under the same booking number, as their data may have been compromised as well.
Ongoing Investigation
- WestJet admits the full scope of the incident is still being determined.
- The FBI is involved in the investigation.
- Threat group Scattered Spider, known for targeting aviation, was active around the same time — though no direct attribution has been made.
Support for Affected Customers
To help impacted individuals, WestJet is offering:
- 2 years of free identity theft protection & monitoring, available until November 30.
The airline insists that “all appropriate measures” are being taken to secure its systems and prevent future breaches.
Alcaeus Services helps organizations strengthen cyber defenses with proactive monitoring, incident response, and identity protection strategies to prevent breaches like this.
