DisclosureLens
HackingTransportation & LogisticsTransportationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPIICriticalResolved

WestJet, an Alberta Partnership

bd_d8c21e8e887f5560 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 13, 2025

Filed

Sep 30, 2025

To disclose

16 weeks

Affected · nationwide

1,200,000240 in this filing

Linked

14 filings

Confidence

65%
Full breach record for WestJet, an Alberta Partnership →

WestJet, an airline, disclosed a cybersecurity incident where a sophisticated criminal third party gained unauthorized access to systems holding personal information. The breach occurred on June 13, 2025, and was discovered on the same day. Approximately 1.2 million individuals were affected, including 240 Maine residents. Compromised data included names, dates of birth, addresses, and travel document details. No credit card numbers or passwords were compromised. WestJet reported the incident to the FBI and offered 24 months of credit monitoring.

Maine clockDiscovered Jun 13, 2025 → Filed with AG Sep 30, 2025109d ⏱ ME AG >30d16 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 16 weeks / 109 days

Jun 13, 2025

Begins

Jun 13, 2025

Discovered

Sep 30, 2025

Filed

This filing is one of 14 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 7d gap

Showing first 10 of 13 linked disclosures.

Filing propagation · 11 filings · 11 states

View merged incident ↗
Indiana State AGSep 29 · first
South Carolina State AGSep 29 · first
Montana State AGSep 29 · first
New Hampshire State AGSep 29 · first
Vermont State AGSep 29 · first
California State AG+1d
Maine State AG+1d · this page
Oregon State AG+4d
Washington State AG+4d
Massachusetts State AG+5d
Texas State AG+8d

Pattern: first filing Sep 29 (IN), last Oct 7 (TX) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.