October 20, 2026 Insights 10 min read

WestJet Data Breach: The OPC Compliance Letter as a Security Checklist

By Cybersecurity Canada Editorial Team | Published October 20, 2026

On October 14, 2026, Privacy Commissioner of Canada Philippe Dufresne announced that the Office of the Privacy Commissioner (OPC) was satisfied that WestJet had met the commitments in a compliance letter the airline signed in July 2026, following the WestJet data breach that affected more than five million current and former customers and employees. With that, the OPC's announcement said the Commissioner has closed the investigation. The compliance letter itself is not a finding that WestJet contravened PIPEDA.

For Canadian businesses, the compliance letter is more than the resolution of one airline's investigation. It is a public checklist of what Canada's federal privacy regulator expects an organization to do after a breach involving personal information. The four areas in that letter (MFA, identity and access controls, security awareness, and independent security assessment) are checks any Canadian SMB can run before an incident, not just after.

What Happened in the WestJet Data Breach?

On June 12, 2025, WestJet experienced a cyberattack when a threat actor used social engineering to gain access to an employee account with administrative privileges. According to the OPC compliance letter, the attacker "posed as the employee, using the employee's personal information," which allowed them to bypass multi-factor authentication. The threat actor then moved laterally through WestJet's systems, deployed ransomware, gained control of virtual servers, and exfiltrated data from the airline's cloud storage.

According to the letter, WestJet discovered the breach the same day and issued a public advisory on June 13, 2025. (WestJet's own pages date the incident to June 13.) The airline reported the breach to the OPC on June 14, 2025. On August 5, 2025, the OPC announced it had opened a Commissioner-initiated investigation into the breach.

The breach affected approximately 5,164,000 Canadian customers and employees, according to the compliance letter. The types of data exposed varied by individual but could include names, dates of birth, email and mailing addresses, phone numbers, gender, information about travel bookings, and passport or other government-issued identification. WestJet confirmed that no credit card numbers, expiry dates, CVV numbers, guest passwords, or Social Insurance Numbers were obtained.

CBC News reported in September 2025 that WestJet said the attack was carried out by a "sophisticated, criminal third party." Neither the OPC nor WestJet has publicly attributed the attack to a specific threat group.

What Is a Compliance Letter Under PIPEDA?

A compliance letter is a voluntary, non-binding commitment an organization makes to the Office of the Privacy Commissioner during a PIPEDA investigation. The organization agrees to take specific actions to improve its security safeguards and address the risks that arose from the breach. If the Commissioner is satisfied the organization has fulfilled all of its commitments, the investigation may be discontinued under paragraph 12.2(1)(c) of PIPEDA, on the basis that the organization provided a fair and reasonable response.

Importantly, a compliance letter is not an admission of wrongdoing. The WestJet letter explicitly states it is "not intended as, or to be construed as, an admission of liability or wrongdoing by WestJet, or as a finding or reporting of finding by the Commissioner... that WestJet was or is in contravention of PIPEDA."

In the October 14 announcement, Privacy Commissioner Dufresne described compliance letters as "an important tool to address privacy issues quickly and efficiently so that Canadians' personal information is protected." In the July 2026 announcement about WestJet's commitments, he said: "Prioritizing privacy helps organizations to build trust. Organizations that invest in strong data governance differentiate themselves as trustworthy stewards of personal information."

What Does PIPEDA Require for Security Safeguards?

Under PIPEDA's Principle 4.7, personal information must be "protected by security safeguards appropriate to the sensitivity of the information." The OPC's guidance on safeguards explains that safeguards must protect against "loss, theft, or any unauthorized access, disclosure, copying, use or modification."

PIPEDA does not prescribe specific security controls. Instead, the OPC states that "your organization must continually ensure it adequately protects the personal information in its care as technologies evolve and as new risks emerge." According to the OPC, safeguards can include physical measures (such as restricted access to offices), organizational measures (such as limiting access on a need-to-know basis), and technological measures (such as passwords and encryption).

This flexibility means organizations cannot point to a PIPEDA checklist and say they have complied. They must assess the sensitivity of the information they hold, the risks they face, and whether their safeguards are appropriate. A compliance letter like WestJet's offers a window into what the OPC considers a "fair and reasonable response" after a breach.

What Security Commitments Did WestJet Make?

The compliance letter details four categories of security improvements that WestJet confirmed it had taken or agreed to demonstrate:

1. Reinforced multi-factor authentication requirements. WestJet implemented mandatory MFA for WestJet Rewards accounts (external guest accounts) and strengthened MFA requirements on employee and contractor accounts, including privileged accounts. The company transitioned "away from less secure MFA methods towards more secure MFA methods, such as authentication apps and hardware-based keys."

2. Strengthened identity and access controls. WestJet reviewed system access privileges and implemented least-privilege and role-based access controls. The company also implemented "a verified process requiring live video or in-person recognition for the vast majority of employee credential and MFA resets."

3. Improved security awareness. WestJet updated its internal privacy and cybersecurity training to focus on "role-based security training tailored to technical access levels and risk profiles," including how to spot and respond to phishing and social engineering attacks.

4. External security assessment. WestJet agreed to engage an OPC-approved independent security firm to assess the effectiveness of its updated safeguards. The company committed to share the firm's findings with the OPC, including any recommendations and how WestJet would address them.

How Can a Canadian SMB Use This Checklist Before an Incident?

The WestJet compliance letter is a case study in what the OPC considers adequate remediation. But Canadian businesses do not need to wait for a breach to apply the same standards. Each commitment area maps to a question you can ask about your own controls.

Is your MFA implemented correctly?

The WestJet breach succeeded because social engineering allowed the attacker to bypass MFA. According to the compliance letter, the attacker posed as the employee using the employee's personal information, and that allowed the attacker to bypass MFA.

This highlights a weakness in weaker MFA methods. SMS-based codes can be intercepted through SIM-swapping. Push notifications can be exploited through MFA fatigue attacks, where an attacker sends repeated prompts until the user approves one. WestJet's remediation included transitioning to authenticator apps and hardware keys, which are more resistant to these attacks.

Ask your IT lead or provider: "Are we using stronger MFA methods (hardware security keys, or authenticator apps with number matching) for our privileged accounts, or are we relying on SMS codes or simple push notifications?"

Do you enforce least-privilege access?

The attacker who compromised WestJet's employee account was able to move laterally through the company's systems, deploy ransomware, and access cloud storage. That lateral movement is possible when accounts have more access than they need.

Least-privilege access means each user account has only the permissions required for that person's job. Role-based access controls assign permissions based on defined roles rather than individual requests. These practices limit how far an attacker can move if one account is compromised.

Ask your IT lead or provider: "Do our accounts have only the access they need, or do we have shared admin credentials or accounts with broad permissions that have accumulated over time?"

How do you verify identity for credential resets?

WestJet's compliance letter describes implementing "live video or in-person recognition for the vast majority of employee credential and MFA resets." This addresses a specific attack vector: an attacker who has enough personal information about an employee to pass a knowledge-based verification question or intercept an SMS code.

Help desk social engineering attacks are common. An attacker calls IT support, claims to be a locked-out employee, provides information gathered from LinkedIn or a prior breach, and gets their credentials reset. If your IT support team resets credentials based only on answering security questions, you have the same vulnerability WestJet addressed.

Ask your IT lead or provider: "What identity verification do we require before resetting a password or MFA device? Would a caller who knew an employee's name, birth date, and employee ID be able to get credentials reset over the phone?"

Does your security training address social engineering?

The WestJet letter describes training that includes "how to spot and respond to phishing and social engineering attacks." Generic annual compliance training is not the same as scenario-based training that covers current attack methods.

Social engineering exploits human trust. Attackers pose as executives, IT support, vendors, or government agencies. They create urgency, fear, or false familiarity. Training should teach employees to verify requests through a separate channel (calling a known number, not the one in the suspicious email) rather than assuming legitimacy based on how a message looks.

Ask your IT lead or provider: "When was the last time we trained our staff on recognizing social engineering? Does the training include scenarios specific to our business, or is it generic videos they click through once a year?"

Have you tested whether your controls actually work?

WestJet agreed to engage an external security firm to assess the effectiveness of its measures and share the results with the OPC. This is the difference between having controls and knowing they work.

Many businesses implement MFA, access controls, and training without ever testing whether those measures would stop an actual attack. Penetration testing, phishing simulations, and tabletop exercises reveal gaps that documentation audits miss. The WestJet compliance letter treats independent assessment as a required step, not an optional one.

Ask your IT lead or provider: "Have we ever had an independent party test our security controls? When was the last time we ran a phishing simulation or a tabletop exercise?"

What Is the Broader Lesson for Canadian Businesses?

The OPC's investigation focused on whether WestJet's safeguards were adequate under PIPEDA at the time of the breach and whether its breach notifications were adequate. The investigation closed with no finding of non-compliance.

But the compliance letter is notable for what it reveals about regulatory expectations. MFA is not enough if the implementation is vulnerable to social engineering. Access controls must be audited and enforced on an ongoing basis, not just documented. Training must address specific threats. And controls must be tested by someone independent.

For Canadian SMBs, the practical question is whether your organization would be in a position to make similar commitments after a breach, or whether you would discover during an OPC investigation that your controls were weaker than you assumed.

The Canadian Centre for Cyber Security's 13 Baseline Controls address many of the same areas: authentication (BC.5), access control (BC.12), security training (BC.6), and incident response (BC.1). The WestJet case shows what those controls look like when a regulator evaluates them after a real breach.

How Can You Evaluate Your Own Readiness?

"If the OPC investigated us tomorrow, would our current security controls satisfy them, or would we need to make the same commitments WestJet did?"

If you are not sure how to answer that question, or if you suspect the answer is unfavourable, the gap is something to address now rather than after an incident.

Our free cybersecurity assessment evaluates your organization against the 13 Baseline Control areas defined by the Canadian Centre for Cyber Security. It runs entirely in your browser, collects no data, and gives you a prioritized view of where your security posture needs attention.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). WestJet Data Breach: The OPC Compliance Letter as a Security Checklist. Retrieved from https://cybersecuritycanada.ca/news/posts/westjet-data-breach-opc-compliance-letter-security-checklist/

Permanent URL: https://cybersecuritycanada.ca/news/posts/westjet-data-breach-opc-compliance-letter-security-checklist/ · Published October 20, 2026