Canadian news — WestJet says the personal information of 1.2 million passengers was stolen in a cyberattack earlier this year, and the stolen data may include names, dates of birth, passport details, and rewards account balances. Canada’s second-largest airline got hit — and the hackers behind it have aviation in their sights.
By Maplestime News Desk | Calgary, Alberta | September 19, 2026
Sources: TechCrunch, WestJet filing with Maine Attorney General, FBI | Last updated: September 19, 2026
Key Takeaways
- WestJet disclosed that a cyberattack earlier this year stole the personal information of 1.2 million passengers
- Stolen data may include names, dates of birth, postal addresses, passports and government-issued IDs, passenger requests and complaints
- Rewards account information — including points balances — may also have been taken
- The airline revealed the incident in June after discovering its systems had been breached
- Media reports have linked the attack to the Scattered Spider hacking group; the FBI warned the group was targeting transportation and aviation
- Australian airline Qantas was allegedly hacked by the same group, with more than 6 million customers’ data stolen
What the WestJet Data Breach Exposed
The scale only became clear in a filing with Maine’s attorney general, where WestJet confirmed the 1.2-million-passenger figure — and disclosed that 240 Maine residents were affected too.
According to the notice, the stolen data may include passenger names, dates of birth, postal addresses, and travel documents including passports and government-issued identity documents, as well as other passenger records such as requests and complaints.
Perhaps the most galling detail for frequent flyers: information related to customer rewards accounts may also have been taken, including points balances. For travellers who’ve banked years of loyalty points, that’s a direct financial exposure.
WestJet disclosed the security incident in June after discovering its systems had been breached and finding that hackers had stolen data from its network. WestJet spokesperson Jennifer Booth did not answer TechCrunch’s questions about the breach when reached by email.
Scattered Spider — The Teenagers Hacking Airlines
Media reports have linked the WestJet breach to Scattered Spider, a financially motivated hacking group of mostly English-speaking teenagers and young adults known for a ruthlessly simple tactic: calling IT help desks and tricking employees into handing over network access.
No zero-days. No sophisticated malware. Just smooth talking.
The FBI and cybersecurity firms warned earlier this year that the hackers were targeting the transportation and aviation industry. They were right — Australian airline Qantas was allegedly hacked by the same group, resulting in the theft of more than 6 million customers’ personal information.
Related: WestJet Strike Vote 2026 — Flight Attendants Vote 99.4% Yes, August Long Weekend Now at Risk
Related: Bell 911 Outage 2026 — Six Provinces Hit as Emergency Calls Failed Thursday Morning
What WestJet Passengers Should Do
If you’ve flown WestJet, assume your data may be in the wild. The combination of names, dates of birth, passport details, and home addresses is exactly what identity thieves need.
Watch for phishing — the hackers now know your name, travel history, and possibly your complaint history with the airline, which makes fake “WestJet support” emails dangerously convincing. Check your rewards account for unauthorized activity. And if the airline offers credit monitoring, take it.
Maplestime will provide updates on the WestJet data breach as announcements are made.
Have a tip about the WestJet data breach? Email [email protected]
Have a correction? Email [email protected]
Should airlines face real penalties when they lose a million passports — or are breaches just the cost of doing business now? Tell us in the comments. And share this with every Canadian who flew WestJet this year.
Enjoying Maplestime? Support independent Canadian journalism — no paywall, no corporate owners.
