ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

We took to the skies in 1996 with just over 200 employees and three aircraft serving five destinations. Today, the WestJet Group offers scheduled service to 120+ destinations in North America, Central America, the Caribbean, Asia and Europe with 14,000+ WestJetters and nearly 200 aircraft. Our ambitious growth plan will create a stronger and more resilient low-cost airline, while offering affordable travel choices for all Canadians. We are dedicated to reliability, operational excellence, driving economic growth, and making our guests and our people central to everything we do. We’re committed to enriching the communities we serve. By working with local organizations and national charitable partners, we invest in initiatives that matter to our guests and people. We’re proud to be a leading Canadian employer and a top talent destination. In 2024, Forbes recognized us as one of Canada’s best employers.

WestJet A.I CyberSecurity Scoring

WestJet

Company Details

Linkedin ID:

westjet

Employees number:

8,654

Number of followers:

241,869

NAICS:

481

Industry Type:

Airlines and Aviation

Homepage:

westjet.com

IP Addresses:

Scan still pending

Company ID:

WES_2025599

Scan Status:

In-progress

AI scoreWestJet Risk Score (AI oriented)

Between 0 and 549

https://images.rankiteo.com/companyimages/westjet.jpeg
WestJet Airlines and Aviation
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
globalscoreWestJet Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/westjet.jpeg
WestJet Airlines and Aviation
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

WestJet

Critical
Current Score
523
C (Critical)
01000
9 incidents
-30.0 avg impact

Incident timeline with MITRE ATT&CK tactics, techniques, and mitigations.

DECEMBER 2025
523
NOVEMBER 2025
519
OCTOBER 2025
594
Breach
24 Oct 2025 • WestJet
WestJet Data Breach Impacting Over a Million Individuals

WestJet, a major Canadian airline serving over 25 U.S. destinations, suffered a **cybersecurity incident** where a **criminal third party** gained unauthorized access to **personally identifiable information (PII)** of **over a million individuals**. The compromised data included **names, dates of birth, addresses, passport/government-issued ID numbers, and medical information**. The breach exposed highly sensitive customer data, prompting legal action by **Lynch Carpenter, LLP**, a national class-action law firm investigating claims for potential compensation. The incident highlights severe risks to **customer privacy, financial security, and trust in the airline’s data protection measures**, with potential long-term reputational and financial repercussions. The breach notification suggests widespread exposure, increasing the likelihood of **identity theft, fraud, and regulatory penalties** under data protection laws (e.g., Canada’s PIPEDA or GDPR for affected EU travelers).

516
critical -78
WES0192701102425
Data Breach
Names Dates of birth Addresses Passport and other government-issued ID numbers Medical information Brand Reputation Impact: Potential (under investigation by Lynch Carpenter, LLP) Legal Liabilities: Potential (Lynch Carpenter, LLP investigating claims for compensation) Identity Theft Risk: High (PII exposed)
Communication Strategy: Public disclosure via GLOBE NEWSWIRE; legal firm (Lynch Carpenter, LLP) investigating claims and notifying affected individuals via breach notification letters.
Personally Identifiable Information (PII) Medical information Number Of Records Exposed: Over 1,000,000 Sensitivity Of Data: High (includes government-issued IDs and medical information) Data Exfiltration: Yes (records obtained by criminal third party) Names Dates of birth Addresses Passport numbers Government-issued ID numbers
Legal Actions: Potential (Lynch Carpenter, LLP investigating claims for compensation)
Ongoing (Lynch Carpenter, LLP investigating claims)
Breach notification letters sent to affected individuals; legal firm (Lynch Carpenter, LLP) offering case reviews via form submission.
SEPTEMBER 2025
609
Cyber Attack
29 Sep 2025 • WestJet
WestJet Data Breach (2025)

WestJet, Canada’s second-largest airline, suffered a **sophisticated cyberattack** in mid-2025, resulting in the **unauthorized access and theft of sensitive passenger data**. The breach, disclosed on **September 29, 2025**, confirmed that a **criminal third party** exfiltrated personal information, including **full names, dates of birth, mailing addresses, passport numbers, travel-related details (accommodations, complaints), and WestJet Rewards account data (IDs, point balances)**. While **credit/debit card numbers, CVV codes, and passwords remained uncompromised**, the attack exposed **government-issued travel documents and loyalty program details** of a subset of **US-based customers**. The airline initiated containment measures early in the incident and engaged **internal security teams and external forensic experts** to investigate. Affected individuals were offered **24 months of TransUnion’s myTrueIdentity monitoring (credit reports, dark web monitoring, $1M identity theft insurance)**. The breach was reported to **law enforcement, including the FBI**, though the **initial attack vector and threat actor identity remain undisclosed**. WestJet emphasized **no evidence of Rewards points being misused** but warned customers to monitor for **phishing attempts and unusual account activity**. The incident highlights risks to **customer trust, regulatory scrutiny, and potential financial fraud**, though flight operations remained unaffected.

591
critical -18
WES5292352093025
Data Breach
Full name Date of birth Mailing address Government-issued travel document details (e.g., passport numbers) Travel-related data (e.g., accommodations, filed complaints) WestJet Rewards information (ID numbers, point balances) Co-branded WestJet RBC Mastercard data (card tier, rewards changes) Internal platforms Mobile app Website Downtime: Technical disruptions reported on June 13, 2025 (duration unspecified) Operational Impact: Flight safety and operations remained unaffected Identity Theft Risk: High (mitigated by 24-month TransUnion myTrueIdentity monitoring service) Payment Information Risk: None (no credit/debit card numbers, expiration dates, CVV codes, or passwords exposed)
Incident Response Plan Activated: Yes (forensic teams involved) Third Party Assistance: Yes (external forensic teams) Law Enforcement Notified: Yes (including FBI) Containment Measures: Implemented early in the incident Remediation Measures: Systems reinforced post-incident Communication Strategy: Formal notification to affected individuals (September 29, 2025); public acknowledgment (June 13, 2025); offer of free identity monitoring services
Personally Identifiable Information (PII) Travel-related data Loyalty program data (WestJet Rewards) Financial account metadata (co-branded credit card tier/rewards) Sensitivity Of Data: High (includes government-issued ID details) Data Exfiltration: Confirmed Full name Date of birth Mailing address Passport numbers WestJet Rewards ID numbers
Enroll in free 24-month TransUnion myTrueIdentity monitoring service (deadline: November 30, 2025) Monitor credit reports and account statements for unusual activity Stay alert for phishing attempts referencing WestJet
Completed (data review finalized on September 15, 2025)
Formal notification sent to affected individuals (September 29, 2025); public advisory issued (June 13, 2025)
Corrective Actions: Systems reinforced post-incident
AUGUST 2025
605
JULY 2025
601
JUNE 2025
613
Cyber Attack
13 Jun 2025 • WestJet
WestJet Cybersecurity Incident Affecting U.S. Residents' Personal Information

WestJet, a Calgary-based airline, detected a cybersecurity incident on **June 13** involving a **sophisticated criminal third party** who gained unauthorized access to its systems. While flight operations remained unaffected, the breach resulted in the exposure of **personal information of U.S. residents**, though no financial data (credit/debit card numbers, CVV codes, expiry dates) or guest passwords were compromised. The incident initially caused **intermittent disruptions** to WestJet’s website and mobile app. After a thorough investigation, the airline confirmed the theft of data and is now notifying affected individuals, advising them to monitor financial statements and credit reports for suspicious activity. WestJet has contained the incident but continues analysis in collaboration with cybersecurity experts and law enforcement. The company emphasized regret and urged vigilance among customers and employees.

595
critical -18
WES0094000092925
Data Breach Unauthorized Access
Data Compromised: Personal information of U.S. residents (exact details unspecified) Website Mobile App Downtime: Intermittent disruptions (duration unspecified) Operational Impact: None (flight operations unaffected) Brand Reputation Impact: Potential reputational harm due to data exposure Identity Theft Risk: Possible (customers advised to monitor accounts and credit reports) Payment Information Risk: None (no credit/debit card numbers, CVV codes, or expiry dates accessed)
Cybersecurity experts Containment Measures: Completed (as of latest update) Direct notifications to affected U.S. residents Public statements Website guidance for customers
Type Of Data Compromised: Personal information (specific types unspecified, excluding payment details and passwords) Sensitivity Of Data: Moderate to High (personal information, potential identity theft risk)
Customers advised to monitor account statements and credit reports for suspicious activity Exercise caution when sharing personal information
Ongoing (analysis continues, containment complete)
Direct notifications to affected U.S. residents Website guidance for monitoring accounts and credit reports
Regular updates provided as investigation unfolds
JUNE 2025
630
Cyber Attack
01 Jun 2025 • WestJet
WestJet Cybersecurity Attack Exposes Passenger Personal Information

WestJet, a Canadian airline, confirmed a cybersecurity breach in June 2025 where a criminal third party accessed its network, exposing passengers' personal data. While flight operations and financial details (credit cards, passwords) remained secure, stolen information included names, dates of birth, mailing addresses, passport/government ID details, and WestJet Rewards data (IDs, point balances). Non-sensitive data for WestJet RBC Mastercard holders was also compromised. The airline collaborated with law enforcement (FBI) and regulators (Transport Canada), offering 24 months of free identity theft monitoring via TransUnion, including $1M expense reimbursement. The breach, attributed to social engineering tactics like phishing, underscored risks of identity theft and scams from exposed travel-related data. No ransomware was explicitly confirmed, but the attack highlighted vulnerabilities in customer service roles and human risk management.

612
critical -18
WES5902059100225
data breach ransomware attack
social engineering phishing (likely via phone calls) unauthorized network access
financial gain data theft
internal systems WestJet app Operational Impact: restricted access for users; no impact on flight operations Brand Reputation Impact: potential reputational damage due to passenger data exposure Identity Theft Risk: high (due to exposure of names, DOBs, addresses, passport/ID details) Payment Information Risk: none (financial data not compromised)
external security experts forensic experts collaboration with law enforcement (FBI) regulatory notifications (Transport Canada) offering 24-month identity theft monitoring via TransUnion public advisory (June 2025) PDF notification (September 2025) customer outreach for affected individuals
names dates of birth mailing addresses travel document details (passports, government-issued IDs) WestJet Rewards ID numbers Rewards point balances (as of incident date) non-sensitive WestJet RBC Mastercard holder data low (for most individuals) high (for identity theft risk due to PII)
Transport Canada
Organizations must prioritize human risk management (HRM) to mitigate social engineering attacks (e.g., phishing, phone scams) targeting customer service roles. Proactive measures like multi-factor authentication (MFA) hardening and employee training are critical to prevent credential theft and lateral movement by attackers.
Implement robust human risk management (HRM) programs to address social engineering threats (phone, email, SMS). Enhance MFA protocols for help desk and outward-facing teams to prevent account takeovers. Monitor dark web for stolen credentials or data related to the breach. Conduct regular security awareness training for employees, especially in customer-facing roles. Evaluate and strengthen incident response plans to minimize data exposure and downtime.
completed (as of September 15, 2025)
24-month identity theft monitoring via TransUnion urge to monitor accounts for suspicious activity
public statements regulatory notifications
likely social engineering (phone-based phishing) compromised legitimate account passenger PII WestJet Rewards data
social engineering attack (likely phishing via phone calls) compromised employee credentials inadequate MFA protections for help desk Offering identity theft protection to affected customers. Collaborating with law enforcement (FBI) and regulators (Transport Canada). Potential review of HRM and MFA policies (implied by expert commentary).
MAY 2025
645
Cyber Attack
01 May 2025 • WestJet
WestJet Cyberattack Leading to Passenger Data Exposure

In June 2025, WestJet fell victim to a cyberattack executed by a **sophisticated, criminal third party**, resulting in the unauthorized access of some passengers' personal information. While the airline confirmed the breach, it clarified that **most compromised data was not classified as 'sensitive'**—suggesting the exposure may have included non-critical details like basic contact information or booking references rather than financial, health, or highly confidential records. The incident prompted a formal notice to affected **U.S. residents**, indicating cross-border implications. WestJet’s ongoing investigation suggests the attackers targeted passenger data, but the absence of large-scale financial fraud or systemic operational disruption implies the impact was contained to **personal (non-sensitive) information leaks**. The airline has not disclosed whether the breach stemmed from a vulnerability, phishing, or direct infiltration, but the involvement of a **criminal actor** points to a deliberate cyber attack rather than an accidental exposure.

627
critical -18
WES1303013093025
Data Breach
Passenger personal information (non-sensitive in most cases) Brand Reputation Impact: Potential reputational harm due to public disclosure of breach Identity Theft Risk: Low (non-sensitive data in most cases)
Incident Response Plan Activated: Yes (ongoing probe mentioned) Communication Strategy: Public disclosure and notice to U.S. residents
Type Of Data Compromised: Personal information (non-sensitive in most cases) Sensitivity Of Data: Low (non-sensitive in most cases) Data Exfiltration: Yes (data obtained by threat actor) Personally Identifiable Information: Yes (unspecified personal information)
Regulatory Notifications: Notice issued to U.S. residents (potential compliance with state/data breach laws)
Ongoing (as of September 29, 2025)
Public disclosure and notice to affected U.S. residents
Notice issued to U.S. residents
APRIL 2025
645
MARCH 2025
642
FEBRUARY 2025
640
JANUARY 2025
637
JUNE 2024
671
Breach
16 Jun 2024 • WestJet
WestJet Cybersecurity Breach Exposes Passenger Personal Information

WestJet, a Canadian airline, experienced a **cybersecurity breach** in mid-2024 after detecting suspicious activity on **June 13**. A **sophisticated criminal third party** gained unauthorized access to its systems, exposing **personal passenger data**, including **names, contact details, travel information, and reservation-related documents**. While no **payment data (credit/debit card numbers, expiration dates, or CVV codes)** was compromised, the breach highlighted vulnerabilities in the aviation sector’s digital infrastructure. The airline collaborated with **law enforcement (FBI, Canadian Centre for Cyber Security)** and notified affected U.S. residents and state authorities. The incident underscores rising threats to airlines, which store vast passenger data and rely on interconnected digital systems. Separately, a **ransomware attack on Collins Aerospace** (a RTX subsidiary) recently disrupted European airports, further emphasizing the sector’s exposure to cyber risks. WestJet’s breach, though limited in financial impact, poses **reputational and operational risks**, particularly given the sensitivity of exposed traveler information.

613
critical -58
WES4192341092925
data breach unauthorized access
names contact details travel information reservation documents Brand Reputation Impact: potential negative impact (not quantified) Identity Theft Risk: possible (due to exposed PII) Payment Information Risk: none (explicitly stated no payment data was compromised)
Communication Strategy: public disclosure and notices to affected U.S. residents
personal information travel-related data Sensitivity Of Data: moderate to high (includes PII but excludes payment data) Data Exfiltration: likely (data was 'exposed' and accessed by unauthorized party) reservation documents
U.S. state attorneys general (for affected residents) Canadian Centre for Cyber Security
ongoing (collaboration with law enforcement)
public statement and direct notices to affected individuals
notices issued to U.S. residents
JUNE 2024
695
Cyber Attack
01 Jun 2024 • WestJet
WestJet Cyberattack Compromises Personal Data of 1.2 Million Customers

Canadian airline **WestJet** suffered a cyberattack in June 2024, compromising the personal data of **1.2 million customers**. The breach, attributed to social engineering (password reset of an employee via Citrix), allowed attackers to infiltrate Windows and Microsoft cloud networks. Exposed data included **full names, dates of birth, mailing addresses, passports/government IDs, travel documents, accommodation requests, complaints, and WestJet Rewards/Mastercard details** (excluding credit/debit card numbers, CVVs, or passwords). The FBI is investigating, and WestJet offered **2-year identity theft protection** to affected individuals. The airline, serving **25M+ travelers annually**, warned that the full scope remains undetermined, with potential further exposures under shared booking numbers. Threat actors linked to **Scattered Spider** (targeting aviation) were suspected but not officially confirmed.

670
critical -25
WES1031510111025
Cyberattack Data Breach Social Engineering
Social Engineering Password Reset Exploitation Citrix Access
Human Error (Social Engineering) Weak Password Reset Mechanisms Citrix Vulnerability
Data Theft Potential Financial Gain Disruption
Internal Systems WestJet App Windows Networks Microsoft Cloud Network WestJet App Unavailability (Duration Unspecified) Disruption of Internal Systems Customer Service Interruptions Potential Increase (Not Quantified) Negative (High-Profile Breach Affecting 1.2M Customers) Potential (Ongoing Investigation) High (PII and Travel Documents Exposed) Low (No Credit/Debit Card Numbers, CVV, or Passwords Compromised)
Technical Experts (Unspecified) FBI Unspecified (Claimed as 'Appropriate Measures') Password Reset Protocols Review Citrix Security Enhancements Microsoft Cloud Security Updates System Restoration Customer Notification Process Public Disclosure (June 13) Customer Notifications (September 15) Regulatory Filings (Maine AG Office) Ongoing Updates Likely (Implied by 'Appropriate Measures')
Full Name Date of Birth Mailing Address Travel Documents (Passport, Government ID) Requested Accommodations Filed Complaints WestJet Rewards Member ID and Points WestJet RBC Mastercard Information (Non-Payment Details) Number Of Records Exposed: 1,200,000 Sensitivity Of Data: High (PII, Travel Documents, Financial Account Details)
Potential Violations (Under Investigation) Ongoing FBI Investigation Maine Attorney General's Office (U.S.)
Social engineering remains a critical attack vector, especially via password resets. Third-party access points (e.g., Citrix) require robust monitoring and hardening. Cloud environments (e.g., Microsoft) must be segmented and protected against lateral movement. Transparent communication with customers and regulators is essential, even when details are incomplete.
Implement multi-factor authentication (MFA) for all password reset and privileged access workflows. Conduct regular social engineering drills and employee training to mitigate human error risks. Enhance logging and monitoring for Citrix and other remote access gateways. Adopt zero-trust principles to limit lateral movement within cloud and on-premises networks. Proactively engage with law enforcement and cybersecurity firms during incident response. Offer comprehensive identity protection services to affected customers to mitigate long-term risks.
Ongoing (FBI Involved, Full Scope Not Yet Determined as of September 2024)
Notify individuals who may have flown under the same booking number (their data may also be exposed). Enroll in 2-year free identity theft protection by November 30, 2024. Monitor financial accounts and credit reports for suspicious activity.
Customers advised to monitor for identity theft and enroll in free protection by November 30, 2024.
Entry Point: Employee Password Reset via Social Engineering Likely (Given Lateral Movement to Windows and Cloud Networks) Customer PII Travel Documents Loyalty Program Data
Successful social engineering attack targeting password reset mechanisms. Inadequate protections for Citrix remote access gateway. Lack of segmentation between Windows networks and Microsoft cloud environment. Review and harden password reset and MFA policies. Enhance Citrix and remote access security controls. Implement network segmentation to limit breach impact. Expand employee cybersecurity training programs.
JUNE 2023
731
Breach
01 Jun 2023 • WestJet
WestJet Cybersecurity Breach (June 2023)

In mid-June 2023, WestJet, a Canadian airline, suffered a cybersecurity breach executed by a **sophisticated criminal third party** that infiltrated its IT systems. While the breach was swiftly contained and did not compromise flight safety, credit card details (including CVV numbers and expiration dates) or customer passwords, **sensitive passenger information was exfiltrated**. The stolen data varied in sensitivity: for most affected individuals, the exposed information was non-sensitive, but for a subset of customers, it included **personal details (name, contact information), travel-related documents (reservation and booking data), and records of their relationship with WestJet**. The airline conducted a forensic investigation with internal and external experts, collaborating with **Transport Canada, the FBI, the Canadian Centre for Cyber Security, and credit agencies (TransUnion, Experian, Equifax)** to mitigate risks. WestJet is actively notifying impacted customers, though the exact scale of the breach—beyond the confirmation of **personal (non-financial) data leakage**—remains undisclosed. The incident aligns with a broader trend of escalating cyber threats in the aviation sector, following similar attacks on Qantas, Aeroflot, and Collins Aerospace in 2023.

673
critical -58
WES5502955093025
Data Breach
Names Contact details Reservation and travel documents Relationship data with WestJet WestJet databases Operational Impact: None (flight safety not compromised) Brand Reputation Impact: Potential reputational harm (customer notifications ongoing) Identity Theft Risk: Low (no credit card or password data exposed) Payment Information Risk: None (CVV, expiration dates, and passwords uncompromised)
Containment Measures: Threat quickly contained (details unspecified) Communication Strategy: Proactive customer notifications; cooperation with regulators/credit agencies
Personal identifiable information (PII) Travel/reservation documents Customer relationship data Sensitivity Of Data: Mixed (mostly non-sensitive; subset includes sensitive PII)
Transport Canada US Federal Bureau of Investigation (FBI) Canadian Centre for Cyber Security Credit agencies (TransUnion, Experian, Equifax)
Completed (forensic investigation concluded)
Direct outreach to impacted individuals
Ongoing notifications to affected customers
Passenger databases
AUGUST 2022
775
Breach
01 Aug 2022 • WestJet
WestJet App Data Breach

WestJet app suffered from a data breach incident due to technical issues that, leaks of consumers' sensitive information. The compromised information includes profile information, phone numbers, home addresses, birthdates, email addresses, WestJet dollars, and flight voucher details. Some have also revealed that they could see the last four digits of another user’s credit card number. They investigated the incident and took guests' privacy extremely seriously.

721
high -54
WES953121122
Data Breach
Technical Issues
profile information phone numbers home addresses birthdates email addresses WestJet dollars flight voucher details last four digits of credit card numbers
profile information phone numbers home addresses birthdates email addresses WestJet dollars flight voucher details last four digits of credit card numbers Sensitivity Of Data: High profile information phone numbers home addresses birthdates email addresses
['Investigated']

Frequently Asked Questions

According to Rankiteo, the current A.I.-based Cyber Score for WestJet is 523, which corresponds to a Critical rating.

According to Rankiteo, the A.I. Rankiteo Cyber Score for November 2025 was 519.

According to Rankiteo, the A.I. Rankiteo Cyber Score for October 2025 was 594.

According to Rankiteo, the A.I. Rankiteo Cyber Score for September 2025 was 609.

According to Rankiteo, the A.I. Rankiteo Cyber Score for August 2025 was 605.

According to Rankiteo, the A.I. Rankiteo Cyber Score for July 2025 was 601.

According to Rankiteo, the A.I. Rankiteo Cyber Score for June 2025 was 612.

According to Rankiteo, the A.I. Rankiteo Cyber Score for May 2025 was 627.

According to Rankiteo, the A.I. Rankiteo Cyber Score for April 2025 was 645.

According to Rankiteo, the A.I. Rankiteo Cyber Score for March 2025 was 642.

According to Rankiteo, the A.I. Rankiteo Cyber Score for February 2025 was 640.

According to Rankiteo, the A.I. Rankiteo Cyber Score for January 2025 was 637.

Over the past 12 months, the average per-incident point impact on WestJet’s A.I Rankiteo Cyber Score has been -30.0 points.

You can access WestJet’s cyber incident details on Rankiteo by visiting the following link: https://www.rankiteo.com/company/westjet.

You can find the summary of the A.I Rankiteo Risk Scoring methodology on Rankiteo by visiting the following link: Rankiteo Algorithm.

You can view WestJet’s profile page on Rankiteo by visiting the following link: https://www.rankiteo.com/company/westjet.

With scores of 18.5/20 from OpenAI ChatGPT, 20/20 from Mistral AI, and 17/20 from Claude AI, the A.I. Rankiteo Risk Scoring methodology is validated as a market leader.