WestJet Data Breach Lawsuit: Five Million People, a Consolidated U.S. Class Action, No Settlement
Active Litigation
In June 2025 an attacker talked their way into a WestJet administrator account and took customer and employee data, including passport details for some travelers. On October 14, 2026, Canada's Privacy Commissioner closed its investigation and put the count at more than five million people. In the U.S., the WestJet class action is one consolidated case in federal court in San Diego. As of October 2026 there is no settlement, no claim form and no deadline.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuits Say
According to the compliance letter WestJet signed with the Office of the Privacy Commissioner of Canada, on June 12, 2025 a threat actor used social engineering to take over the account of an employee with administrative privileges, bypassed multi-factor authentication, deployed ransomware and exfiltrated data from WestJet's cloud storage. WestJet posted a public advisory on June 13, 2025.
The data varied by person: names, dates of birth, email and mailing addresses, phone numbers, gender, recent travel bookings, and passport or other government ID information. Reporting on the Maine filing adds WestJet Rewards points balances. WestJet says no card numbers, CVVs, guest passwords or Social Insurance Numbers were taken.
The U.S. plaintiffs allege WestJet negligently failed to secure their information, that they overpaid for its services, and that they face a higher risk of identity theft, lost time and a loss in the value of their data. The Yee complaint pleads negligence, breach of implied contract, unjust enrichment and declaratory judgment, and alleges victims were not told until Sept. 29, 2025. These are allegations; WestJet has not been found liable.
Case details
Two proposed class actions were filed in the U.S. District Court for the Southern District of California: Willis v. WestJet Airlines, Ltd., No. 3:25-cv-02785 (filed October 18, 2025), and Yee v. WestJet Airlines Ltd., No. 3:25-cv-02982 (filed November 3, 2025). On December 2, 2025 the court consolidated them under the caption In re WestJet Airlines Data Breach Litigation, Case No. 3:25-cv-02785-LL-MSB, and appointed interim class counsel. WestJet did not oppose consolidation. The order set January 5, 2026 as the deadline for a consolidated complaint, with WestJet's response due 30 days later. You can read the court record on GovInfo.
Separately, Canada's privacy regulator opened an investigation on August 5, 2025. That was a regulatory review, not a lawsuit, and it paid nothing to anyone.
Status: Consolidated Case, Regulator Closed, No Settlement
The recent news is Canadian. On October 14, 2026 the Privacy Commissioner of Canada said WestJet had met the security commitments in its July 2026 compliance letter and closed the investigation. That closes the regulator's file. It does not resolve the WestJet data breach lawsuit and does not trigger any payment.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
The Privacy Commissioner puts the breach at more than five million current and former customers and employees. WestJet's U.S. filing with Maine's attorney general, reported in October 2025, listed 1.2 million people, including 240 in Maine. The two figures come from different filings and counts; the newer regulator figure is the larger one.
WestJet began emailing or mailing notices to affected employees on July 23, 2025 and to other affected people on August 7, 2025. U.S. residents were notified starting Sept. 29, 2025. Your notice is the practical test. It lists which of your data was involved and how to use the identity protection WestJet offered. If you were not contacted and want to know whether you were included, WestJet's U.S. notice gives 1-888-937-8538 and wjresponseteam@westjet.com.
What a WestJet Settlement Could Pay
If the case does settle, data breach settlements usually pay back documented losses, make a smaller flat payment and offer monitoring. Passport and travel-document exposure is unusual, so the claims may be valued differently from a typical email-and-address breach. For ranges from resolved cases, see our data breach settlement calculator. That is context, not a prediction.
How cases like this one end
Our copy of the federal courts’ own case database covers 118,291 other personal injury casesclosed in U.S. federal district courts between 2015 and 2026, 3.9% of them filed as class actions:
- 39.6% ended in a settlement recorded by the court. Another 14% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 39.6% and 53.6%.
- 5.7% were decided on a motion before any trial.
- 1 in 109 reached a trial (0.9%), after a median of 23.9 months.
- Median time from filing to the end of the case: 9 months.
- Only 802 of them (0.7%) record a money award at all; the median of those is $537,500.
These are base rates for this type of case (federal other personal injury cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
WestJet Data Breach Timeline
June 12–13, 2025 — The Attack
An attacker uses social engineering to take over an administrator account and exfiltrates data. WestJet posts a public advisory on June 13 and reports to Canada's privacy regulator on June 14.
July 23 – August 7, 2025 — First Notices
WestJet starts notifying affected employees on July 23 and other affected individuals on August 7. The Privacy Commissioner opens an investigation on August 5.
September 29, 2025 — U.S. Notice
WestJet notifies U.S. residents after finishing its data analysis on September 15. The Maine filing lists 1.2 million people.
October–November 2025 — Lawsuits Filed
Willis (No. 3:25-cv-02785) is filed on October 18 and Yee (No. 3:25-cv-02982) on November 3, both in the Southern District of California.
December 2, 2025 — Cases Consolidated
The court combines both suits as In re WestJet Airlines Data Breach Litigation and sets January 5, 2026 for a consolidated complaint.
October 14, 2026 — Regulator Closes Its File
The Privacy Commissioner says WestJet met its July 2026 commitments, puts the count at more than five million, and closes the investigation. The U.S. case continues with no settlement.
Three Things to Watch For
This breach exposed passport details and Rewards balances, which gives scammers convincing material to work with:
“Claim your WestJet settlement” pages
There is no settlement and no claims site. A page asking for your passport number or a photo of your ID to “verify” a WestJet claim is collecting the same data the attackers wanted.
Messages quoting your Rewards balance
Reports say Rewards points balances may have been taken, so a phishing email can quote your real balance and offer “compensation points” if you log in through its link. Go to WestJet directly instead.
Callers posing as WestJet or Cyberscout
Your real notice came by email or letter and explained how to enroll. If someone phones and asks for a fee, card details or your full passport number, hang up and call the number in WestJet's own notice.
WestJet Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a WestJet data breach settlement or claim form?
No. As of October 2026 the U.S. case, In re WestJet Airlines Data Breach Litigation, is in pretrial proceedings. There is no settlement, no fund, no claim form and no deadline. If that changes, class members will get notice from a court-appointed administrator.
How many people were affected?
Canada's Privacy Commissioner says more than five million current and former customers and employees. WestJet's earlier U.S. filing with Maine's attorney general listed 1.2 million people. Your own notice is the best evidence of whether you were included.
What data was exposed?
It varied by person: names, dates of birth, email and mailing addresses, phone numbers, gender, recent travel bookings, and passport or other government ID information. Rewards points balances may also have been taken. WestJet says no card numbers, CVVs, guest passwords or Social Insurance Numbers were obtained.
Where is the WestJet lawsuit filed?
In the U.S. District Court for the Southern District of California in San Diego, Case No. 3:25-cv-02785. It combines the Willis and Yee suits, which were consolidated on December 2, 2025.
How much compensation can I get for a data breach?
From WestJet, nothing yet, because nothing has been agreed or awarded. In settled breach cases, payments usually depend on documented losses, with a smaller flat amount for everyone else. Our data breach settlement calculator shows ranges from comparable cases.
Does the Privacy Commissioner closing its investigation mean the case is over?
No. The October 14, 2026 closure means WestJet met the security commitments it made to Canada's regulator. It is not a court ruling and pays nothing. The U.S. class action is a separate proceeding.
Do I need to do anything to join the WestJet class action?
No. Under Rule 23, if a class is certified or a settlement is approved, you are included unless you opt out. There is nothing to sign up for now. Keep your notice letter or email.
Is this the same as other WestJet lawsuits?
No. This page covers only the 2025 data breach. WestJet has faced unrelated cases, including workplace-harassment litigation. For that topic, see our harassment lawsuit page.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Open Class Action SettlementsSettlements you can file a claim in right now
- Settlement Payout CalculatorHow a fund divides once claims and fees are counted
- Air France Data Breach LawsuitAnother airline customer-data case and where it stands