CALGARY — WestJet has posted an update following the cybersecurity incident that made headlines for the airline in June.
“Unfortunately, we can now confirm that certain data was illegally obtained from WestJet’s systems. Thanks to our internal precautionary measures, no credit card or debit card numbers and no guest user passwords were obtained,” said WestJet in the new post.
As reported earlier, the incident affected access to some of WestJet’s servers and software system.
The breach came as other airlines around the world reported cybersecurity incidents as well, including Qantas.
In a new post dated July 18, WestJet shared the following update …
“Further to previous updates, and following a thorough investigation, WestJet is now able to share more information related to the June IT cybersecurity incident.
“On June 13, 2025, we identified suspicious activity on our systems. We immediately investigated and determined that these were the actions of a sophisticated, criminal third party, who gained unauthorized access to our systems.
“Given the significant importance of data security to the integrity of our business, we are prepared for incidents of this nature and followed our response planning by taking immediate action to contain the incident and secure our systems. As a result, at no point was the safety and integrity of our airline operations in question.
“We engaged internal and external experts to perform a technical and forensic investigation to identify the nature and scope of the event.
“Unfortunately, we can now confirm that certain data was illegally obtained from WestJet’s systems. Thanks to our internal precautionary measures, no credit card or debit card numbers and no guest user passwords were obtained.
“What was obtained was some personal and travel-related data, which varies from person to person. In line with regulatory requirements, WestJet has identified those individuals, who we will contact in the coming days to provide information and support regarding this incident. We have also posted additional information and guidance on our website.
“Given the criminal nature of this incident, we closely cooperated with law enforcement, the Canadian Centre for Cyber Security, and have notified the relevant authorities, including Transport Canada, the Office of the Privacy Commissioner of Canada and its provincial and international counterparts as appropriate.
“Containment is complete, and some additional system and data security measures have been implemented. However, analysis is ongoing, and we will continue to take measures to further enhance our cybersecurity protocols. We sincerely regret this situation, and we remain grateful for the support and patience of the thousands of guests and WestJetters who place their trust in us.”
