WestJet Data Breach Notice (Oregon Attorney General)

The records of 1,200,000 people are now in the hands of an unknown party following a breach at WestJet that occurred on June 13, 2025. The airline did not notify Oregon authorities until October 3, 2025 — an interval of 112 days.

If you live in Oregon and received a letter from WestJet in recent weeks, that letter is the only reliable way to know whether your information was included. Absence of a letter usually means you were not affected, but anyone who has moved since June 13, 2025 should contact the airline directly to confirm their status.

Personal information carries long-term value

The filing lists personal information as the category exposed in the incident. While the exact fields are not detailed beyond that term, this type of data typically includes name combined with contact details and government identifiers. These pieces remain useful for identity thieves and fraudsters years after a breach because they cannot be reissued like a credit card or password.

No passwords were exposed. The record contains no credential-related data, so there is no need to change any WestJet account password because of this incident. That is genuine good news and removes one immediate worry.

What this exposure actually enables

With enough personal information, someone can attempt to open new accounts in your name, file fraudulent tax returns, or impersonate you when dealing with government agencies and financial institutions. The combination of name, address, and government ID is often sufficient to bypass basic identity checks that many organisations still rely on.

Because no permanent government or biographic identifiers beyond the broad category are explicitly confirmed in the filing, the precise risk level for any single person depends on the exact data points included in their record. Your own notification letter will list the specific information that applied to you.

The significance of the 112-day gap

The breach took place on June 13 and the filing was made on October 3. That four-month window is the most notable detail in the public record. Notification timelines vary by state law and by when an investigation concludes, so the gap alone does not prove wrongdoing. It does, however, mean that anyone whose information was taken had four additional months of unknown exposure before official notice began reaching affected customers.

How to determine whether you are in the affected group

WestJet is required to notify impacted individuals directly, almost always by mail to the last known address. If you have not received such a letter, your information was most likely not part of the 1.2 million records included in the filing. The only exception is if you have changed address since the June 13 incident date. In that case, reach out to WestJet’s customer service using the contact details in their official breach notice to verify your status.

Practical steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. A fraud alert forces lenders to verify your identity before opening new accounts and is free. It lasts one year and can be renewed.
• Monitor your credit reports for unfamiliar accounts or inquiries. You are entitled to one free report per bureau every week at AnnualCreditReport.com. Review them regularly for the next 12 to 24 months.
• File your taxes early next year. This reduces the window in which a fraudster could file a fake return using your Social Security number or other identifiers.
• Be extremely cautious with unsolicited requests for personal information. Scammers often use data from breaches to make their calls, texts, or emails appear legitimate. Never provide details over the phone or email unless you initiated the contact.
• Consider credit monitoring or identity theft protection services if you want ongoing alerts. These are not required, but they can notify you quickly if new accounts appear in your name.

The exposure of personal information from 1.2 million customers is significant in scale. What matters most now is recognising that the risk is ongoing rather than immediate, and that the actions above give you meaningful control over the parts you can still influence. The letter from WestJet remains your primary evidence of whether you need to take these steps at all.