Privacy Commissioner Closes Investigation of WestJet Cyberattack

Privacy Commissioner of Canada Philippe Dufresne says WestJet has met the commitments that it made to strengthen its security safeguards following a cyberattack that impacted more than five million current and former customers and employees.

In 2025, the company experienced a breach when an unauthorized threat actor was able to access and exfiltrate data from the company. 

Following the breach, the Office of the Privacy Commissioner of Canada (OPC) launched an investigation and engaged with the company to ensure that it adequately addressed the risks to Canadians related to the breach.

In a compliance letter with the OPC that WestJet signed in July, the company confirmed it had reinforced multi-factor authentication requirements, strengthened identity and access controls, and improved its overall security awareness. 

WestJet also agreed to engage an external security firm to assess the effectiveness of those new measures and to share the outcome of that assessment with the OPC, including any additional recommendations made by the firm, and inform how those recommendations would be addressed.

Now that the company has demonstrated to the OPC’s satisfaction that it has met all of its commitments, Commissioner Dufresne has closed the investigation.

“WestJet has honoured its commitment to ensure stronger protections for the personal information of its customers and employees. It has implemented the measures that I had requested following the data breach and, as a result, the investigation is now closed,” Dufresne said. 

“This case is a testament to the value of early engagement between businesses and authorities on serious incidents. Compliance letters are an important tool to address privacy issues quickly and efficiently so that Canadians’ personal information is protected.”