TL;DR: WestJet disclosed a cyberattack on June 13, 2025. Its investigation, concluded September 15, 2025, found 1.2 million people affected. Exposed data: names, dates of birth, addresses and travel documents such as passports and government IDs, plus some travel details and WestJet Rewards IDs and balances. Passwords and credit card details were not affected. WestJet offers 24 months of TransUnion identity monitoring. Watch for WestJet-themed phishing.
What happened
According to SC World, WestJet first disclosed the incident on June 13, 2025, blaming a "sophisticated, criminal third party." The investigation wrapped up September 15, 2025 with 1.2 million people affected.
What was exposed
| Data | Status |
|---|---|
| Names, dates of birth, addresses | Exposed |
| Passports and other government IDs | Exposed |
| Travel details (accommodation requests, complaints) | Some records |
| WestJet Rewards ID and points balance | Some members and some WestJet RBC Mastercard holders |
| Passwords | Not affected |
| Credit card details | Not affected |
| Rewards points | Not at risk of theft, per WestJet |
Why passport data is a big deal
You can change a password in a minute. A passport number, name and birthday together are much harder to undo. They can help someone open accounts, pass ID checks or impersonate you convincingly. It’s the travel equivalent of losing your house keys with your address taped to them.
What to do
- Activate the free monitoring. WestJet offers 24 months of identity monitoring through TransUnion’s myTrueIdentity, with up to $1 million in expense reimbursement insurance. Use the code in your letter on the official site.
- Consider a fraud alert with Equifax and TransUnion (how).
- Report it if your passport is misused. If you see signs of misuse, contact Passport Canada about replacing it.
- Watch for phishing. WestJet warned scammers may impersonate WestJet or related companies. Expect "flight refund", "rewards expiring" and "verify your identity" messages.
- Check your Rewards balance now and then anyway.
Is that WestJet email real?
Don’t click links in unexpected WestJet emails. Log in to the app or type westjet.com yourself. WestJet won’t need your full passport details again by email.
Check all your breaches
Travellers are often in several breaches at once. A free email exposure check shows them all. Also see our Air Canada scams guide.
Frequently Asked Questions
How many people were affected by the WestJet data breach?
1.2 million people, according to WestJet’s investigation completed September 15, 2025.
Were passports exposed in the WestJet breach?
Yes. Travel documents such as passports and other government IDs were exposed.
Were credit cards or passwords stolen?
No. WestJet says account passwords and credit card details were not affected.
What is WestJet offering affected customers?
24 months of free identity monitoring through TransUnion’s myTrueIdentity, with up to $1 million in expense reimbursement insurance.