WestJet data breach: June 13, 2025 cyberattack, reservation data taken, 1,200,000 people

How many people were affected by the WestJet data breach?

1,200,000, by the count WestJet gave two US states. Indiana's attorney general records the same total in its 2025 report, with 818 Indiana residents, a notice sent on September 29, 2025 and a breach date of June 13, 2025. Oregon's list gives 1,200,000 too, with the same notice date. WestJet's own notice gives no number. It was the eleventh-largest total in Indiana's 2025 report, the place it holds in the largest data breaches of 2025.

Record	What it counts	Number
Indiana attorney general, 2025 report	People affected in total	1,200,000
Indiana attorney general, 2025 report	Indiana residents	818
Oregon Department of Justice	People affected in total	1,200,000

Washington's attorney general lists a notice from WestJet reported on October 3, 2025, with 7,333 Washingtonians affected. Its record names names, full dates of birth, passport numbers, medical information and other information as the information compromised. The figure counts Washington residents only.

What happened at WestJet?

WestJet identified suspicious activity on its systems on June 13, 2025 and determined that a sophisticated, criminal third party had gained unauthorized access. It says it contained the incident and that the safety of its airline operations was never in question. Its forensic investigation confirmed that data was obtained, and it finished analyzing that data on September 15, 2025.

WestJet says it worked with the FBI and the Canadian Centre for Cyber Security. It notified the US credit bureaus, the attorneys general of the states with affected residents, Transport Canada and the Office of the Privacy Commissioner of Canada.

Date	What happened	Source
June 13, 2025	Suspicious activity found; criminal third party in the systems	WestJet notice; Oregon list
June 14, 2025	End of the breach window	Oregon list
September 15, 2025	Analysis of the stolen data completed	WestJet notice; Oregon list
September 29, 2025	Notice date	Oregon list
October 3, 2025	Reported to Oregon	Oregon list

Notice came 108 days after the attack was found. The notice-delay guide compares that with other notices.

What information was exposed in the WestJet breach?

It varies by person. WestJet says that for most people the information was not sensitive, but for some it includes name, contact details, information and documents provided for a reservation and travel, and data about their relationship with WestJet. It says no credit or debit card numbers, expiry dates or CVV numbers, and no guest user passwords, were obtained. Your own letter or email lists the exact items.

How do I find out if my data was involved?

If WestJet emailed or wrote to you, that notice lists your data and explains how to get the identity protection services. If it did not, WestJet asks you to call 1-888-937-8538 or email wjresponseteam@westjet.com. WestJet says it contacts people only where it has sufficient contact information, so some people affected will not be contacted directly.

What is WestJet offering?

Fraud assistance and remediation from Cyberscout, a TransUnion company, with identity protection details in each person's notice. The guide to credit monitoring offers explains what these services cover and what a free credit freeze adds.

Was Scattered Spider behind the WestJet attack?

WestJet has not named the attacker. Its letters call it a "sophisticated, criminal third party". The Record reported that WestJet was one of several airlines attacked in June 2025, allegedly by actors connected to the Scattered Spider cybercriminal group, and that WestJet's systems were largely restored after five days. Google's incident responders had warned at the time of a wider Scattered Spider campaign against airlines, and Hawaiian Airlines and Qantas also reported attacks.

The Record also reported that the FBI, the Canadian Centre for Cyber Security and the Office of the Privacy Commissioner of Canada are investigating the incident. Its account of the letters adds a warning: family members who flew on the same booking number should be told, because their information may also be involved.

Date	What happened	Source
June 13, 2025	WestJet finds suspicious activity	WestJet notice
About June 18, 2025	Systems largely restored after five days	The Record
September 15, 2025	Investigation finds a criminal third party had access	The Record, citing the letters
September 29, 2025	Notice to Indiana residents (818 of 1,200,000)	Indiana report
By October 1, 2025	Notices on WestJet's website and to US regulators; 1.2 million people	The Record; Oregon list

What the record leaves open

• Who the criminal third party was and how it got in; WestJet has not confirmed the Scattered Spider reports.
• How many of the 1,200,000 had travel documents in the data.
• How many of the 1,200,000 live outside the United States; the two state records give the same total and say nothing about where people live.