Canada’s privacy commissioner has closed the WestJet investigation

On October 14, 2026, Privacy Commissioner of Canada Philippe Dufresne closed his office’s investigation into WestJet. The airline had a breach in 2025 in which an unauthorized party accessed and copied data. The commissioner says WestJet has now done what it agreed to do. Closing the file does not bring that data back.

If you were a WestJet customer or employee and you were notified in 2025, the practical risk is the copy that left the company, not a new break-in this month.

What the commissioner closed

The Office of the Privacy Commissioner’s news release says the 2025 breach affected more than five million current and former customers and employees. After the breach, the office opened an investigation and dealt with the company directly.

In a compliance letter WestJet signed in July 2026, the airline said it had tightened multi-factor authentication, strengthened identity and access controls, and improved security awareness. It also agreed to hire an outside firm to test those measures and to share that firm’s findings with the commissioner, including any further recommendations and how WestJet would handle them. The commissioner says those commitments have been met, and the investigation is closed.

Dufresne’s statement calls the case a reason to engage early: “Compliance letters are an important tool to address privacy issues quickly and efficiently so that Canadians’ personal information is protected.”

The release does not list the categories of data that were copied in 2025, and it does not say the copied data has been recovered or deleted from whoever took it.

What is still worth doing

1. Treat the 2025 notice as still in force. A closed investigation means the company put the agreed safeguards in place. It does not mean the information that was copied is gone. If WestJet told you that you were affected, keep whatever that notice told you to watch for.
2. Be careful with messages about the breach or about a refund. A scammer who has a name, an email, and the fact that you fly WestJet can write a convincing note. WestJet will not ask you to send a password, a verification code, or a payment card number by email or text to “confirm” this investigation. Our guide to phishing that uses leaked details covers the pattern.
3. Lock the account you actually use. Turn on multi-factor authentication for the email address on your booking, and for the WestJet account itself if you still have one. A password that was only stored at the airline is a different problem from the mailbox a reset link would go to.
4. If you were notified, the usual Canadian steps still apply. A fraud alert, and a credit lock where your province offers one, are there for when identity details were in the copy. Our after-a-breach checklist walks through them. If you were not notified, this closure is not a new list of victims.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.

Sources

• Office of the Privacy Commissioner of Canada, Privacy Commissioner of Canada satisfied with WestJet’s enhanced security measures following cyberattack; closes investigation, October 14, 2026