WestJet Battles Cyber Breach: App Safeguards and Trust at Stake

Summary

• WestJet reported a cybersecurity incident on June 13, 2025, involving its internal systems and mobile app.
• Some users were locked out of the WestJet app, and others saw intermittent errors on the app and website.
• WestJet brought in specialist teams and is working with law enforcement and Transport Canada.
• The airline says flight operations were not affected.

What WestJet has said so far

WestJet, Canada’s second-largest airline, is dealing with a cyberattack that reached its internal systems and its mobile app. Was customer data taken? The airline has not said. It is asking guests and employees to be careful about sharing personal information while the investigation continues.

How the WestJet incident unfolded

On June 13, 2025, WestJet said it was aware of a cybersecurity incident involving internal systems and the WestJet app that had restricted access for several users. Details were thin. The airline called it too early to speculate and promised updates as it learned more.

By June 15 the airline said some guests could still see intermittent interruptions or errors on the app and WestJet.com while it worked out the extent of the incident. Its flights, it said, were operating safely and were not affected.

WestJet’s response

WestJet activated specialized internal teams and is working with law enforcement and Transport Canada to investigate and limit the damage. Its stated priority is protecting the personal information of guests and staff.

Until the airline says more, customers should be wary of emails, texts or calls that mention a WestJet booking or the breach, and avoid sharing personal details with anyone who contacts them unexpectedly.

Update: data confirmed taken

In a later update, WestJet confirmed that a sophisticated criminal third party had obtained some personal and travel-related data from its systems. The details vary by person. For some guests they include names, contact details and documents provided for reservations and travel.

No credit or debit card numbers and no guest passwords were taken, the airline said. It notified the Canadian Centre for Cyber Security and the Office of the Privacy Commissioner of Canada and is contacting affected people directly, offering identity theft protection where available.

Rebuilding customer trust

Customer trust will be the harder repair. WestJet’s early updates were brief. That is common while forensic work is underway, but it leaves customers guessing about their own exposure for days or weeks.

WestJet says containment is complete and that it has added system and data security measures. It has also put an information page on its website for people who want to check whether they were affected.

What travelers should do

The breach is one of several attacks on airlines in June 2025, and it shows how much passenger data sits behind a single mobile app. Booking details, travel documents and loyalty records are useful to fraudsters even without card numbers.

For WestJet customers, the practical steps are simple. Watch for phishing that references real bookings, check loyalty account activity and use the identity protection offered if you receive a notice.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.