WestJet Privacy Investigation Closes After Security Commitments Are Met

Canada’s privacy regulator says the airline completed corrective commitments following its 2025 breach, including external assessment of new safeguards.

A new milestone in an older incident

Canada’s Privacy Commissioner announced October 14 that WestJet had met its security commitments and that the investigation into its 2025 cyberattack was closed. The regulator said the incident affected more than five million current and former customers and employees. This week’s news concerns the completion of corrective work, rather than a new breach. The announcement identifies stronger multifactor authentication, identity and access controls, and security awareness among the measures WestJet adopted.

Independent assessment formed part of the commitment

The regulator said WestJet also committed to an external assessment of the new measures, sharing the results and explaining how further recommendations would be addressed. The published compliance letter describes a June 12, 2025 intrusion involving social engineering of an employee account with administrative privileges. The letter is expressly not an admission of liability or a finding that WestJet violated the privacy law. Closing the investigation should not be read as a promise that future attacks cannot occur.

Separate restoration from durable correction

For transportation businesses, the case offers a useful distinction between getting services working and demonstrating that corrective controls work. Our analysis is that an incident program should track both. A service-restoration ticket might close when a system becomes available. A corrective action should close when its owner has evidence that the change addresses the intended risk. Combining those milestones can make a quick operational recovery look like a finished security investigation when longer-term work remains.

Make the handoff reviewable

An MSP supporting a transport operator can turn that distinction into a practical review: identify the change, the responsible owner, the validation performed and any remaining exceptions. An external reviewer should be able to understand what was tested without relying on the memory of the incident team. Exceptions need a next step and review date rather than an indefinite accepted status. The same discipline helps management understand which improvements are complete and which still require resources. WestJet’s announcement is a concrete example of a regulator closing a case after commitments were demonstrated; other organizations can use the milestone to examine the evidence behind their own recovery claims.