OPC investigation into 2025 WestJet cybersecurity incident concludes with no findings of non-compliance

The OPC initiated its investigation in August 2025 to review WestJet’s security safeguards and breach notification practices following a sophisticated social engineering cyberattack that resulted in unauthorized access to certain company systems.

Following its review, the OPC determined that the measures implemented by WestJet in response to the incident were fair, reasonable, and adequately addressed the requirements of PIPEDA. The Commissioner made no finding that WestJet was, or is, in non-compliance with PIPEDA in connection with the incident.

Since the incident, WestJet has further strengthened its cybersecurity and privacy program through investments in identity and access management, expanded multi-factor authentication requirements, enhanced threat detection and monitoring capabilities, hardening of harden critical systems and infrastructure, and enhanced organization-wide guidance to reinforce security awareness.

Throughout its response, WestJet prioritized supporting affected individuals through direct notifications, dedicated customer support resources, enhanced communication channels, and credit monitoring and identity protection services.

The closure of the investigation reflects WestJet's ongoing commitment to safeguarding personal information and maintaining robust privacy and cybersecurity practices. WestJet will continue investing in security controls, monitoring capabilities, employee awareness, and industry-leading practices to help protect against evolving cyber threats.