WestJet, an Alberta Partnership

WestJet based in Calgary, Alberta, Canada, Illinois, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-09-15 and reported on 2025-10-07. 10,487 Texas residents were affected. 1,200,000 individuals affected in total. Types of information involved: Name of individual;Address;Government-issued ID number (e.g. passport, state ID card);Medical Information;Other;Date of Birth. Consumers were notified via Posted at company website or special website;U.S. Mail;Email;Broadcast on Texas-wide Media.

WestJet reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-10-04. 1,847 Massachusetts residents were affected.

WestJet reported a data breach to the Oregon Attorney General. The breach was reported on 2025-10-03. The breach occurred during 6/13/2025 - 6/14/2025. The breach was discovered on 9/15/2025. 1,200,000 individuals were affected. Notice was sent on 9/29/2025.

WestJet experienced a phishing-based cyberattack on June 13, 2025, resulting in unauthorized access to systems containing passenger PII. The incident is resolved. Data involved includes names, DOBs, addresses, and travel document info. 7,333 Washington residents affected. WestJet notified the FBI and offers 24 months of credit monitoring.

WestJet experienced a cybersecurity incident on June 13, 2025, where a sophisticated criminal third party gained unauthorized access to systems holding personal information. The incident is now resolved. Affected data includes names, dates of birth, mailing addresses, and travel document information (passports/government IDs). Credit card numbers and passwords were not compromised. WestJet reported the incident to the FBI and is offering 24 months of identity monitoring to affected US residents.

WestJet, an airline, disclosed a cybersecurity incident where a sophisticated criminal third party gained unauthorized access to systems holding personal information. The breach occurred on June 13, 2025, and was discovered on the same day. Approximately 1.2 million individuals were affected, including 240 Maine residents. Compromised data included names, dates of birth, addresses, and travel document details. No credit card numbers or passwords were compromised. WestJet reported the incident to the FBI and offered 24 months of credit monitoring.

WestJet reported a data breach to the Indiana Attorney General. The breach occurred on 2025-06-13 and was reported on 2025-09-29. 818 Indiana residents were affected. 1,200,000 individuals affected in total.

WestJet, an Alberta Partnership, disclosed a cybersecurity incident identified on June 13, 2025, involving unauthorized access by a sophisticated criminal third party. The incident is now resolved. Personal information potentially affected includes names, dates of birth, mailing addresses, and travel document details (passport/government ID). Credit card numbers, CVVs, and passwords were not compromised. WestJet reported the incident to the FBI and is cooperating with the investigation. Affected US residents were offered 24 months of complimentary credit monitoring and identity theft protection via TransUnion.

WestJet disclosed a resolved cybersecurity incident discovered on June 13, 2025. A sophisticated criminal third party gained unauthorized access to systems holding personal information. Data involved included names, DOBs, addresses, and travel document details. No credit card numbers or passwords were compromised. WestJet reported the incident to the FBI and offered 24 months of free identity monitoring.

WestJet, an Alberta Partnership, notified the NH Attorney General of a cybersecurity incident affecting 289 New Hampshire residents. On June 13, 2025, WestJet identified suspicious activity and determined a sophisticated criminal third party gained unauthorized access to its systems. The attacker obtained certain data, including names, dates of birth, mailing addresses, and travel document information (e.g., passport numbers). Credit card numbers and passwords were not compromised. WestJet engaged forensic experts, secured its environment, and reported the incident to the FBI. The incident is now resolved. WestJet is offering 24 months of complimentary identity theft and monitoring services.

WestJet, an Alberta Partnership, disclosed a cybersecurity incident identified on June 13, 2025, involving unauthorized access by a sophisticated criminal third party. The incident affected personal information of US residents, including names, dates of birth, mailing addresses, and travel document details. WestJet reported the incident to the FBI and is cooperating. The incident is resolved. WestJet offers 24 months of complimentary identity theft monitoring via TransUnion.

WestJet notified the Iowa AG of a cybersecurity incident discovered on June 13, 2025, involving unauthorized access by a sophisticated criminal third party. The incident affected 367 Iowa residents, exposing names, dates of birth, addresses, and travel document information. WestJet reported the incident to the FBI, improved security controls, and offered 24 months of free credit monitoring.

WestJet, an Alberta Partnership, experienced a cybersecurity incident on June 13, 2025, involving unauthorized access by a sophisticated criminal third party. The incident affected personal information of certain United States residents, including names, dates of birth, mailing addresses, and travel document details (e.g., passport numbers). Credit card numbers and CVVs were not compromised. WestJet reported the incident to the FBI, conducted a forensic investigation, and provided 24 months of complimentary credit monitoring and identity theft protection services to affected individuals. The incident is now resolved.

WESTJET filed a data-breach notice with the Illinois Attorney General in September 2025 (case 25-09-488). The register records the breach as discovered on September 15, 2025. Personal information types reported: medical information, passport number. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.