Airline Commits To Improving Security Measures Following Data Breach

On July 14, 2026, the Office of the Privacy Commissioner of Canada (the OPC) announced that WestJet had signed a Compliance Letter under which it agreed to demonstrate that it had strengthened its security measures following a cyberattack that affected more than five million current and former WestJet customers and employees.           

The cyber incident occurred in June 2025, when a threat actor used social engineering to bypass multi-factor authentication and gain access to an employee account with administrative privileges. Through the employee’s account, the threat actor accessed WestJet’s virtual servers and exfiltrated data from its cloud storage. The compromised information included names, dates of birth, passport information, email addresses, government issued identifiers, among other information. The OPC launched an investigation into the breach in August 2025.

At the OPC’s request, WestJet voluntarily agreed to commitments outlined in a Compliance Letter, including hiring an independent security firm to assess the effectiveness of its post-breach security improvements. WestJet will also provide the OPC with a confidential summary of the firm’s assessment which will include the firm’s evaluation of WestJet’s information security safeguards before and after the breach and at a minimum:

1. a description of the safeguard enhancements;
2. an assessment of the effectiveness of WestJet’s current safeguards to protect personal information and to prevent, detect, and respond to the threats and risks that led to the breach;
3. the identification of any remaining gaps in assessed security safeguards; and
4. recommended solutions and timelines to address those gaps.

In addition, WestJet will inform the OPC which of the firm’s recommendations it has accepted and how it plans to implement them, as well as which recommendations it has declined and why, and any additional measures it intends to implement. Once the OPC is satisfied that WestJet has fulfilled its commitments under the Compliance Letter, the investigation will be discontinued. 

The OPC noted that Compliance Letters are an effort to resolve privacy issues more efficiently and reduce risks to Canadians more expeditiously.

The Compliance Letter signed by WestJet is available here.

Summary By: Victoria Di Felice