WestJet Airlines revealed on Monday that some of its customers’ personal information was stolen during a cyberattack in June. The Canadian airline said the breach did not include sensitive financial details like credit card numbers, CVV codes, or passwords.
The company reported that a skilled criminal group accessed its systems on June 13, exposing passenger records. This included names, contact information, reservation details, and other data linked to customer accounts. WestJet confirmed that payment information remained secure and was not accessed.
WestJet has completed the initial containment of the breach and put extra security measures in place. They are continuing to investigate the incident. The airline has hired Cyberscout, a company that helps with fraud prevention and support, to assist customers who might be affected.
Authorities including the FBI, Canadian Centre for Cyber Security, and privacy regulators in both Canada and the U.S. are involved in the inquiry. Notifications have gone out to American residents who may have been impacted, along with state attorneys general, credit bureaus, and federal transportation officials.
The time it took for WestJet to disclose the breach has raised questions. Industry expert Anthony Dagostino pointed out that waiting nearly four months to notify customers is longer than the timelines required for publicly traded companies in the U.S. He also wondered if the exposed data was properly encrypted or protected.
This incident adds to recent cyberattacks hitting the airline industry. Earlier this month, a ransomware attack on Collins Aerospace disrupted airport operations in Europe, causing delays in baggage handling and check-ins.
For airlines and travel companies, the WestJet breach is a reminder of how vulnerable they are to cyber threats. These businesses hold a lot of passenger data and rely heavily on digital systems. Protecting that information is crucial, but so is responding quickly and transparently when something goes wrong, to avoid damage to reputation and regulatory penalties.