WestJet investigates cybersecurity incident affecting systems and mobile app
Learn More
WestJet, Canada's second-largest airline, is reporting a cybersecurity incident that disrupted access to internal systems and the company's mobile application.
The airline activated response teams and is cooperating with law enforcement agencies and Transport Canada to investigate the matter and limit potential impact. WestJet emphasized that its flight operations continue to run safely and remain unaffected by the cybersecurity incident. Access to some software services and systems has been impacted.
The nature of the attack, types of compromised data and number of affected individuals has not been disclosed.
WestJet advised all guests and employees to exercise caution when sharing personal information during this period and apologized for any service disruptions experienced as a result of the security breach.
WestJet has committed to providing regular updates every 12 hours or sooner as additional information becomes available.
Update - As of September 29, 2025 WestJet notified U.S. residents that their personal information may have been compromised in the incident. The airline claims that no payment card information or passwords were accessed, and containment of the incident is complete. The investigation continues and the number of affected individuals or exposed data is not disclosed.
As of September 30th, WestJet reports the following types of data exposed:
- Full names
- Dates of birth
- Email addresses
- Mailing addresses
- Phone numbers
- Gender
- Travel documents (passport or government-issued identification information)
- Recent travel booking history and reservation numbers
- Requested accommodations during travel
- Filed complaints
- WestJet Rewards Member ID numbers, points balances, and other membership information
- WestJet RBC Mastercard, WestJet RBC World Elite Mastercard, or WestJet RBC World Elite Mastercard for Business information (card identifier type and points balance changes only)
As of 1st of October 2025, WestJet reports the personal information of 1.2 million passengers was stolen the cyberattack.
