WestJet experienced a data breach stemming from unauthorized access by a sophisticated criminal third party using social engineering. The incident occurred on June 12, 2025, and WestJet discovered it on the same day. The company issued an official U.S. cyber notice and sent breach notifications to affected U.S. residents.
The breach affected approximately 1.2 million individuals in the U.S. and about 5.164 million Canadian employees and customers overall. Exposed data included names, dates of birth, addresses, email and mailing addresses, phone numbers, travel and reservation details, passport or other government identification information, loyalty and account details, and complaints or accommodation requests. WestJet stated that no credit or debit card numbers, CVV, guest passwords, or Social Insurance Numbers were obtained. Rewards-account information may have been exposed, but passwords and card data were not compromised. No medical data was involved.
Additional details, including a comprehensive list of affected U.S. states and specifics on potential regulator notifications beyond the Maine AG, have not been fully disclosed at this time. Further information may emerge as investigations continue, and affected individuals may receive delayed notices.