WestJet Cyberattack Investigation Closed: OPC Confirms Compliance

• The Office of the Privacy Commissioner of Canada closed its investigation into a 2025 WestJet cyberattack on October 14, 2026.
• The cyberattack impacted over five million current and former WestJet customers and employees, with data exfiltrated by an unauthorized actor.
• WestJet committed to and implemented enhanced security measures, including stronger multi-factor authentication and identity controls.
• The airline agreed to an external security assessment and to share its findings and action plans with the OPC.
• Commissioner Philippe Dufresne praised WestJet's early engagement and commitment to corrective actions, highlighting the effectiveness of compliance letters.

This case illustrates that a proactive approach, including transparent communication with the regulator and a concrete commitment to implementing enhanced security measures, can lead to a timely resolution of regulatory scrutiny.

The Office of the Privacy Commissioner of Canada (OPC) announced on October 14, 2026, that its investigation into a significant cyberattack affecting WestJet has concluded. Privacy Commissioner Philippe Dufresne confirmed that WestJet successfully fulfilled all commitments made to his office regarding the enhancement of its security protocols. This resolution follows a 2025 data breach where an unauthorized actor gained access to and exfiltrated sensitive information, impacting over five million current and former customers and employees of the airline.

Following the incident, the OPC initiated an investigation and collaborated with WestJet to ensure that the risks posed to Canadians were adequately addressed. As part of this engagement, WestJet signed a compliance letter in July, outlining specific measures to bolster its cybersecurity posture. These included reinforcing multi-factor authentication requirements, strengthening identity and access controls, and improving overall security awareness among its personnel. The airline also committed to engaging an independent external security firm to evaluate the effectiveness of these new safeguards.

WestJet's compliance letter further stipulated that the airline would share the findings of the external security assessment with the OPC. This included any additional recommendations put forth by the firm, along with a detailed plan on how WestJet intended to implement those suggestions. The closure of the investigation by Commissioner Dufresne signifies that WestJet has demonstrated to the OPC's satisfaction that it has met these agreed-upon commitments, thereby strengthening its data protection framework.

This outcome underscores the importance of robust cybersecurity incident response in Canada and proactive engagement with regulatory bodies like the Office of the Privacy Commissioner of Canada. The specific enhancements, such as reinforced multi-factor authentication and improved access controls, are critical elements of modern PIPEDA security safeguards designed to protect personal information against evolving threats. The OPC's oversight ensures that organizations are held accountable for their data protection responsibilities.

Commissioner Dufresne highlighted the positive implications of this case, stating that WestJet honored its pledge to enhance protections for the personal information of its customers and employees by implementing the corrective measures requested after the data breach. He emphasized that the investigation's closure demonstrates the value of early and constructive engagement between businesses and regulatory authorities when serious incidents occur. Compliance letters, in this context, serve as an effective mechanism for swiftly and efficiently addressing privacy concerns, ultimately safeguarding the personal information of Canadians.

This Canadian privacy investigation closure sets a precedent for how organizations can navigate significant data breaches. It illustrates that a proactive approach, including transparent communication with the regulator and a concrete commitment to implementing enhanced security measures, can lead to a timely resolution of regulatory scrutiny. For legal professionals, this case reinforces the strategic benefit of advising clients on early engagement with the OPC and developing comprehensive post-breach remediation plans to mitigate potential regulatory penalties and restore public trust.

This development demonstrates that proactive and early engagement with the Office of the Privacy Commissioner of Canada, coupled with concrete commitments to enhance security measures, can lead to the timely closure of data breach investigations. Lawyers should advise clients on the strategic benefits of such cooperation and the importance of robust post-breach remediation plans to mitigate regulatory scrutiny.

Source: Original reporting via Office of the Privacy Commissioner of Canada