Canada’s second largest airline WestJet said the personal information of 1.2 million passengers was stolen in a cyberattack and data breach earlier this year.
The airline disclosed the number of affected passengers in a filing with Maine’s attorney general, which confirmed 240 residents in the state were also affected.
According to the notice, the stolen data may include passenger names, dates of birth, postal addresses, and travel documents, including passports and government-issued identity documents, as well as other passenger accommodations, such as requests and complaints.
WestJet said information related to customer rewards may have also been taken, including points balances and other information related to reward accounts.
The Canadian airline giant disclosed a security incident in June after it discovered its systems were breached and it found that hackers had stolen data from its network.
WestJet spokesperson Jennifer Booth did not answer TechCrunch’s questions about the breach when reached by email.
Media reports have linked the WestJet breach to a hacking group known as Scattered Spider, a financially motivated group of mostly English-speaking teenagers and young adults known for calling IT help desks and tricking employees into granting them access to corporate networks.
The FBI and cybersecurity firms earlier this year warned that the hackers were targeting the transportation and aviation industry. Australian airline Qantas was allegedly hacked by the same group, resulting in the theft of more than 6 million customers’ personal information.
