WestJet cyberattack exposed passenger data, no card data accessed

CALGARY — WestJet said Monday that a cyberattack on June 13 exposed personal information for some passengers, though the airline said most cases did not involve financial data or user passwords. The company notified affected U.S. residents as part of an ongoing investigation into what it described as unauthorized access by a sophisticated criminal third party.

WestJet said its internal precautions prevented attackers from obtaining customers' credit or debit card numbers, expiry dates and CVV codes, and that no guest user passwords were stolen. The airline said the data accessed varied by individual but included names, contact details and documents or information provided in connection with reservations and travel. In some notifications, WestJet indicated passports and other identification documents may have been among the material exposed.

The airline said the findings reflect the results of an investigation completed on September 15, though it added that analysis remains ongoing and it is continuing to review the full scope of the incident. "We continue to work alongside our technical experts to determine the full extent of the incident," the company said in its customer notice.