Overview
- A filing with Maine’s attorney general indicates 1.2 million passengers were affected, including 240 residents of that state.
- Exposed information varies by person and can include names, dates of birth, postal addresses, travel documents such as passports or government IDs, accommodation requests or complaints, and WestJet Rewards details.
- WestJet says attackers did not obtain credit or debit card numbers, expiration dates, CVV codes, or account passwords.
- The company completed its forensic analysis on September 15, has begun notifying identified U.S. residents, and is offering two years of identity protection via TransUnion with support from Cyberscout.
- WestJet is working with the FBI and the Canadian Centre for Cyber Security, reports no impact on flight operations or known misuse of the data, and continues to assess the breach’s full scope.