WestJet, a major Canadian airline serving over 25 U.S. destinations, suffered a cybersecurity incident where a criminal third party gained unauthorized access to personally identifiable information (PII) of over a million individuals. The compromised data included names, dates of birth, addresses, passport/government-issued ID numbers, and medical information. The breach exposed highly sensitive customer data, prompting legal action by Lynch Carpenter, LLP, a national class-action law firm investigating claims for potential compensation. The incident highlights severe risks to customer privacy, financial security, and trust in the airline’s data protection measures, with potential long-term reputational and financial repercussions. The breach notification suggests widespread exposure, increasing the likelihood of identity theft, fraud, and regulatory penalties under data protection laws (e.g., Canada’s PIPEDA or GDPR for affected EU travelers).
TPRM report: https://www.rankiteo.com/company/westjet
"id": "wes0192701102425",
"linkid": "westjet",
"type": "Breach",
"date": "10/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Over 1,000,000 individuals',
'industry': 'Aviation',
'location': 'Canada (serves over 25 U.S. destinations)',
'name': 'WestJet Group',
'type': 'Airline'}],
'customer_advisories': 'Breach notification letters sent to affected '
'individuals; legal firm (Lynch Carpenter, LLP) '
'offering case reviews via form submission.',
'data_breach': {'data_exfiltration': 'Yes (records obtained by criminal third '
'party)',
'number_of_records_exposed': 'Over 1,000,000',
'personally_identifiable_information': ['Names',
'Dates of birth',
'Addresses',
'Passport numbers',
'Government-issued ID '
'numbers'],
'sensitivity_of_data': 'High (includes government-issued IDs '
'and medical information)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Medical information']},
'date_publicly_disclosed': '2025-10-24',
'description': 'WestJet Group, a Canadian airline, announced a cybersecurity '
'incident where a criminal third party obtained records '
'containing personally identifiable information (PII) of over '
'a million individuals. The compromised data includes names, '
'dates of birth, addresses, passport and other '
'government-issued ID numbers, and medical information. Lynch '
'Carpenter, LLP is investigating potential claims for '
'compensation related to this breach.',
'impact': {'brand_reputation_impact': 'Potential (under investigation by '
'Lynch Carpenter, LLP)',
'data_compromised': ['Names',
'Dates of birth',
'Addresses',
'Passport and other government-issued ID '
'numbers',
'Medical information'],
'identity_theft_risk': 'High (PII exposed)',
'legal_liabilities': 'Potential (Lynch Carpenter, LLP '
'investigating claims for compensation)'},
'investigation_status': 'Ongoing (Lynch Carpenter, LLP investigating claims)',
'references': [{'date_accessed': '2025-10-24',
'source': 'GLOBE NEWSWIRE Press Release'},
{'source': 'Lynch Carpenter, LLP Investigation Page',
'url': 'https://www.lynchcarpenter.com'},
{'source': 'WestJet Official Website',
'url': 'https://www.westjet.com/en-us'}],
'regulatory_compliance': {'legal_actions': 'Potential (Lynch Carpenter, LLP '
'investigating claims for '
'compensation)'},
'response': {'communication_strategy': 'Public disclosure via GLOBE NEWSWIRE; '
'legal firm (Lynch Carpenter, LLP) '
'investigating claims and notifying '
'affected individuals via breach '
'notification letters.'},
'threat_actor': 'Criminal third party',
'title': 'WestJet Data Breach Impacting Over a Million Individuals',
'type': 'Data Breach'}