WestJet westjet.com WestJet data breach: what happened and what to do
WestJet confirmed that data was stolen in a June 2025 cyberattack affecting about 1.2 million people. It included names, addresses, dates of birth, contact details and government ID details. WestJet says payment card data and passwords weren't taken.
View all 13,115 breaches- Breach date
- 13 Jun 2025
- Affected
- 1,200,000
- Data exposed
- Names, Physical addresses, Dates of birth, Email addresses, Phone numbers, Government issued IDs
- Last updated
What happened
WestJet, the Canadian airline, was hit by a cyberattack on June 13, 2025. Flight operations weren't affected, but the company later confirmed that personal data was stolen. Its filing with the Maine Attorney General puts the total at about 1.2 million people, according to SecurityWeek and Infosecurity Magazine. California and Washington's attorney general lists carry shorter state-level counts, which cover only residents of those states.
The data included names, addresses, dates of birth, email addresses and phone numbers, government-issued ID details used for travel, reservation and travel details, accommodation requests and complaints, and WestJet Rewards ID numbers and points balances. Some card type and points data tied to WestJet RBC Mastercard accounts was also involved.
WestJet says credit and debit card numbers, expiry dates, CVV numbers and guest passwords were not compromised. It isn't aware of misuse and is offering identity theft protection or credit monitoring to affected people.
Travel details plus contact info is a good setup for phishing. A message that mentions your real booking or Rewards number looks legitimate. Researchers have linked the attack to Scattered Spider, but WestJet hasn't named a group.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Criminals use real details to sound credible. Don't click links in unexpected emails, texts or calls. Contact the company using the number on its official website.
- 2
Check your WestJet Rewards account
Log in directly at westjet.com, review recent activity, and change your password. Turn on two-factor authentication if it's offered.
- 3
Consider a credit freeze if your ID details were involved
Government ID details are enough to attempt identity theft. A freeze at Equifax, Experian and TransUnion (or Equifax and TransUnion in Canada) is free.
- 4
Use the free credit monitoring if you were offered it
WestJet is offering identity theft protection or credit monitoring to affected people. Sign up with the code in your letter before it expires, and read your statements for charges you don't recognize.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when something new turns up.
Frequently asked
Was I affected by the WestJet data breach?
WestJet is notifying affected people directly. If you booked or held a Rewards account, watch for an email or letter.
What was exposed?
Names, addresses, dates of birth, email and phone details, government ID details, travel and reservation details, and Rewards ID numbers and balances.
Were my card details stolen?
WestJet says credit and debit card numbers, expiry dates, CVV numbers and guest passwords were not compromised.
Should I change my password?
WestJet says passwords weren't taken. Changing yours is still a cheap precaution, especially if you reuse it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
