WestJet cyberattack remains unresolved one week in, but operations unaffected

A cyberattack against WestJet that began last week remains unresolved, as questions linger about the nature and fallout of the breach.

The country’s second-largest airline said this week it was working to assess whether sensitive data or customers’ personal information was compromised after hackers accessed its internal systems.

The attack, which was detected late last week, has not affected operations but that some customers may run into “intermittent interruptions or errors” on WestJet’s website and app, according to an online advisory.

Spokesman Josh Yeats said Friday that investigations in collaboration with law enforcement are ongoing, but the company has not specified what type of cyber-intrusion took place, such as a malware or ransomware attack.

The breach at the Alberta-based airline arrived just ahead of foreign leaders, who gathered last weekend for the G7 summit in Kananaskis, Alta., though no direct link to the event has been identified.

Airlines and airports have become increasingly popular prey for hackers, as their troves of personal and financial data and global reach make for tempting targets.

Japan Airlines said it was hit by a cyberattack on Dec. 26, causing delays to more than 20 domestic flights over the winter holidays. The airline said it was able to stop the onslaught and restore its systems hours later, with no impact on flight safety.

In September, hackers demanded US$6 million in bitcoin from the operator of the Seattle-Tacoma International Airport for documents they stole during a ransomware attack the month before and later posted on the dark web, according to the airport. The Port of Seattle, which owns and operates the airport, opted not to pay, an official said at the time.

WestJet first posted about the “cybersecurity incident” on June 13, soon after it started.

“WestJet has made significant progress on safeguarding our digital environment and supporting the specialized teams working to resolve the cyber incident,” the company said in an update Wednesday.

“We are working as quickly as possible to assess any potential data in scope.”

This report by The Canadian Press was first published June 20, 2025.

— With files from The Associated Press