Overview

• A filing to Maine’s attorney general confirms roughly 1.2 million people were affected by the June 13 cyberattack that disrupted WestJet’s app and website.
• Stolen data includes names, addresses, dates of birth, and details from passports or other government IDs, along with travel-related information such as accommodation requests and complaints.
• Membership information for WestJet Rewards and certain details linked to WestJet‑branded RBC Mastercard accounts may have been exposed, but full card numbers and account passwords were not.
• WestJet is notifying affected individuals and offering 24 months of identity monitoring and fraud assistance, including up to $1 million in expense reimbursement.
• Investigations by Canada’s privacy commissioner and law enforcement are ongoing, and WestJet says the FBI is assisting, while reported attribution and entry methods remain unconfirmed.