WestJet’s investigation into a 2025 cyberattack has been closed after Canada’s Privacy Commissioner confirmed that the airline fulfilled commitments to strengthen its privacy and cybersecurity safeguards.
The Office of the Privacy Commissioner of Canada announced the decision on October 14, 2026, saying the attack affected more than five million current and former WestJet customers and employees.
The regulator said WestJet implemented the measures required under a compliance agreement and demonstrated that its response was fair and reasonable under the Personal Information Protection and Electronic Documents Act.
Table of Contents
What the WestJet investigation found
The breach occurred in June 2025, when an unauthorized threat actor accessed and exfiltrated data from WestJet systems.
The Office of the Privacy Commissioner launched its own investigation in August 2025 to examine the airline’s security safeguards and its breach-notification practices.
Rather than issue a formal finding of non-compliance, the regulator worked with WestJet through a compliance letter signed in July 2026.
That agreement required WestJet to provide information about upgraded protections, arrange an independent external security assessment and report how it would address any remaining recommendations.
The commissioner’s office said the investigation was closed after WestJet satisfied those commitments.
Security changes made by WestJet
WestJet said it has expanded multi-factor authentication requirements and strengthened identity and access controls since the incident.
The airline also reported improvements to threat detection and monitoring, additional protection for critical systems and infrastructure, and broader employee guidance on cybersecurity awareness.
WestJet further committed to reviewing the effectiveness of its updated safeguards through an independent security assessment.
The privacy commissioner’s office said the airline provided the information and follow-up required to demonstrate that the measures addressed the risks linked to the breach.
Commissioner Philippe Dufresne said WestJet had honoured its commitment to provide stronger protection for customers’ and employees’ personal information.
What information was involved
The regulator’s announcement identified more than five million current and former customers and employees as affected by the cyberattack.
The exact information involved varied by individual and was not fully detailed in the commissioner’s October announcement.
WestJet previously said the incident involved unauthorized access to certain company systems and that it was working with law-enforcement agencies and other authorities.
In a separate notice to affected individuals, the airline said potentially exposed information could include names, dates of birth, contact details, travel-document information, booking history and WestJet Rewards details, depending on the person.
That notice said payment-card numbers, expiry dates, security codes and account passwords were not involved.
What the closure means for affected travellers
The closure means the federal privacy investigation has ended after the commissioner accepted WestJet’s corrective measures.
It does not change the fact that unauthorized access and data exfiltration occurred in 2025.
It also does not prevent affected individuals from taking personal precautions or pursuing other legal remedies that may be available to them.
Travellers who received a breach notification should continue to be cautious about unexpected emails, text messages or calls requesting passwords, account details or identity documents.
Customers should use WestJet’s official website or app when checking bookings and avoid relying on links contained in unsolicited messages.
Anyone who suspects misuse of personal information should contact the relevant financial institution, credit bureau or law-enforcement agency.
WestJet’s next cybersecurity obligations
Although the investigation is closed, WestJet said it will continue investing in security controls, monitoring systems and employee training.
The airline also said it would continue reviewing its practices as cyber threats evolve.
The decision comes as Canadian companies face increasing scrutiny over how they protect large volumes of customer and employee information.
For WestJet, the privacy commissioner’s decision removes the immediate federal investigation connected to the 2025 incident while leaving the airline responsible for maintaining the safeguards it put in place.
Frequently Asked Questions
What happened in the WestJet cyberattack investigation?
The Office of the Privacy Commissioner of Canada closed its investigation after determining that WestJet fulfilled commitments to strengthen its privacy and cybersecurity safeguards.
How many people were affected by the WestJet breach?
The Privacy Commissioner said the 2025 cyberattack affected more than five million current and former WestJet customers and employees.
What security changes did WestJet make?
WestJet expanded multi-factor authentication, strengthened identity and access controls, improved threat monitoring and hardened critical systems and infrastructure.
Were WestJet payment-card numbers exposed?
WestJet previously said payment-card numbers, expiry dates, security codes and account passwords were not involved, although the information affected varied by individual.
What should affected WestJet customers do now?
Affected customers should remain alert for phishing attempts, use official WestJet channels and contact their financial institution or credit bureau if they suspect identity misuse.
Fact-Checked: Key facts were checked against statements from the Office of the Privacy Commissioner of Canada, WestJet and the official compliance letter. The controlling closure date, October 14, 2026, and the July 2026 compliance-letter timing are temporally consistent.
Disclaimer: This report provides general information and is not legal, financial or cybersecurity advice.