Reported to the CA Attorney General on September 30, 2025.
CA residents may qualify for compensation. Free attorney review — no obligation, no upfront cost.
Check My Rights →WestJet was the subject of a data breach notification filed with the CA Attorney General. The AG filing was recorded on September 30, 2025. The breach or discovery date reported in the filing is June 13, 2025.
WestJet operates as a major commercial airline, facilitating international and domestic travel for millions of passengers annually. Because of the nature of the aviation and travel industry, the company routinely collects and maintains a vast repository of highly sensitive personal, financial, and travel-related information from its customers and frequent flyer members. This data is essential for booking flights, processing ticket purchases, managing loyalty rewards programs, and complying with stringent federal transportation security mandates. Consequently, WestJet acts as a custodian for immense volumes of confidential consumer data, making its digital infrastructure an attractive target for cybercriminals seeking to exploit high-value personal information. In 2025, WestJet reported a significant security incident to the California Attorney General, prompting widespread concern among travelers whose data was entrusted to the airline. While the exact vector of the cyberattack continues to be evaluated, breaches affecting major transportation and travel providers typically involve sophisticated techniques such as unauthorized access to cloud-stored reservation databases, third-party vendor compromises, or credential-stuffing attacks targeting online account portals. These incidents often exploit vulnerabilities in digital networks or web applications, allowing malicious actors to bypass perimeter defenses and dwell undetected within corporate systems for extended periods before exfiltrating sensitive consumer files. The data compromised in incidents of this scale generally encompasses a dangerous combination of personally identifiable information, travel itineraries, and financial details. Exposure of full names, dates of birth, and contact information immediately places victims at an elevated risk of targeted phishing campaigns and social engineering attacks. Furthermore, when frequent flyer credentials, passport details, and linked payment card information are compromised, cybercriminals can execute unauthorized account takeovers, hijack reward miles, make fraudulent travel bookings, or leverage the stolen credentials to facilitate broader identity theft. The inclusion of government-issued identification numbers, such as passport details, compounds the gravity of the breach, as these documents are nearly impossible for victims to alter and are foundational to identity fraud. Under California consumer protection laws, including the California Consumer Privacy Act and state data breach notification statutes, corporations operating within the state have an affirmative legal duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information they hold. WestJet's obligation required the deployment of robust administrative, technical, and physical safeguards—such as multi-factor authentication, network segmentation, continuous intrusion monitoring, and rigorous vendor risk management—to prevent unauthorized access. The occurrence of a data breach of this magnitude strongly indicates potential lapses in these mandatory security protocols, raising serious questions regarding whether the company fulfilled its statutory duties to protect consumer data. Receiving an official data breach notification letter from WestJet is a formal acknowledgment that your private information was compromised due to inadequate corporate security measures. Legally, this notification serves as foundational evidence establishing standing to participate in a class action lawsuit against the company. Under modern data breach jurisprudence, affected individuals may be entitled to legal remedies even before suffering direct financial loss, as the imminent threat of identity theft and the time and expense required to monitor credit constitute compensable harms. Our firm evaluates these cases on a contingency fee basis, meaning affected consumers pay nothing out of pocket, and legal fees are recovered only if a successful recovery or settlement is achieved on your behalf.
Based on the data types reported in this filing, affected individuals face the following specific risks:
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Phone numbers exposed in breaches are used for SIM swapping attacks — hijacking your number to bypass two-factor authentication on financial accounts.
Under the California Consumer Privacy Act (CCPA), you may have a legal claim against WestJet if any of the following apply:
Applicable law: This breach was reported under the California Consumer Privacy Act (CCPA), which establishes your right to seek damages from WestJet.
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
When login credentials are exposed, the costs of downstream account compromises — password managers, security audits, and recovery costs for hijacked downstream accounts — can be recovered. Courts in recent class actions have awarded damages for credential exposure even without proven misuse.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under California Consumer Privacy Act (CCPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from WestJet does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by WestJet during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Most data breach class actions resolve within 18 to 36 months, though timelines vary by court and complexity. Your participation requires minimal effort — typically completing a claim form. Our office handles all litigation; you are notified when a settlement is reached.
Received a notification letter from WestJet?
Read our dedicated guide — what the letter means and exactly what to do.
If you were affected by the WestJet data breach, you may be entitled to compensation. Submit your information below for a free attorney review — no obligation, no upfront cost.
Source: State Attorney General filing, CA
View Official AG Filing →WestJet breach?
Free case review · No fee unless you win