On 14 October 2026 the Privacy Commissioner of Canada closed his investigation into WestJet. There was no finding that WestJet broke the law. The case was settled through a compliance letter instead, and what that letter asked for is more useful to a board than a penalty would have been.
What happened
On 12 June 2025, an attacker used social engineering to get into the account of a WestJet employee with administrative privileges. According to the compliance letter, the attacker posed as the employee, using that employee’s personal information, and that was enough to get past multi-factor authentication. From there they moved through WestJet’s systems, deployed ransomware, took control of virtual servers and copied data out of cloud storage.
About 5,164,000 employees and customers were affected. The data varied by person and could include names, dates of birth, contact details, recent travel bookings, and passport or other government ID details. WestJet says no payment card numbers, passwords or Social Insurance Numbers were taken.
What the regulator asked for
WestJet set out the safeguards it had added since the breach. Among them: stronger MFA using authentication apps and hardware keys, least-privilege access, and live video or in-person verification for most employee credential and MFA resets. The Commissioner did not take that list on trust. In the letter, WestJet agreed to:
- have a reputable, independent security firm, approved by the regulator, assess whether the new safeguards work against the threats behind the breach, and identify any remaining gaps;
- give the regulator a confidential summary of that assessment, and a technical briefing if asked;
- answer every one of the firm’s recommendations: whether it accepted it, and if so, whether it had been done or when it would be.
The file was closed only once the Commissioner was satisfied those commitments had been met.
Three points for boards
1. MFA is only as strong as the process for resetting it
WestJet had MFA. The attacker did not break it; they talked their way around it by posing as an employee. Most MFA failures look like this. The weak point is whoever can reset a password or enrol a new device when someone says they have lost their phone. WestJet’s own fix shows where the gap was: live video or in-person checks before most resets. Our earlier briefing on MFA explains why it is still worth having. This case shows what has to sit around it.
2. The regulator accepted independent evidence, not the company’s own word
The letter did not ask WestJet to confirm it had improved. It required an outside firm, approved by the regulator, to test the improvements, and WestJet to respond to each finding. That is a clear signal of what a Canadian regulator will accept as “fixed”. The assessment carries weight because the firm testing the controls did not build or sell them. It is the line we hold too: we never assess work we have advised on, and we never sell the fix for anything we assess.
3. How fast you tell the regulator matters
WestJet discovered the breach the day it happened, posted a public notice the next day, and reported to the regulator on 14 June 2025, two days after discovery. Direct notices to affected individuals took longer, going out in late July and early August 2025. The compliance letter records each of those dates. In our view, a prompt, documented timeline like this is part of what makes it possible to resolve a case by agreement rather than a finding.
For some organisations, speed is about to become a legal duty. Once the Critical Cyber Systems Protection Act is in force, designated operators will have to report a cyber security incident to the Communications Security Establishment within a period set by regulations, no longer than 72 hours. That section is not in force yet and the regulations have not been published, but 72 hours is a sensible test for any board now.
The question your board should ask
“If someone convincingly impersonated one of our administrators tomorrow, who could reset their MFA, what proof would they ask for, and how would we find out it had happened?”
If the honest answers are “the help desk”, “a date of birth” and “we wouldn’t”, that is the gap WestJet had to close after its breach. If you want an independent view of how your own resets would hold up, the first conversation is free.
Checked on 19 October 2026 against the Office of the Privacy Commissioner of Canada’s news releases of 14 July and 14 October 2026, the WestJet compliance letter signed on 8 July 2026, and the Justice Laws Website (Critical Cyber Systems Protection Act, section 17).