Modern burglars no longer pick locks. They borrow keys.

Key points

  • Unauthorized access to WestJet’s systems exposed roughly 1.2 million people.
  • The attacker did not force a lock: they got in using legitimate access.
  • Access controls and identities are now the primary surface to lock down.
  • Three measures close off most of this scenario, and none require a budget.

What happened at WestJet?

On June 13, 2025, a criminal actor gained unauthorized access to WestJet’s internal systems and mobile app. Names, addresses, dates of birth, government-issued identification, and travel information were stolen. Roughly 1.2 million people are affected.

The company offered twenty-four months of credit monitoring to those affected. The exact intrusion vector has not been made public, and we won’t speculate here: what’s confirmed is enough to draw the lesson from.

What stands out in this case isn’t the assumed sophistication of the attack, but the nature of the data taken. Government-issued identification can’t be changed the way a password can. Its exposure fuels identity fraud for years, long after the incident has left the headlines.

Why has identity become the primary attack surface?

Because perimeter defenses have improved significantly, while access controls have largely stayed the same. An attacker holding a valid credential has nothing left to bypass: they present themselves as a legitimate user, and security tools see them as one.

Systems and applications exposed without sufficiently strong authentication or segmentation become an entry point. Once inside, an attacker moves around and helps themselves, without triggering the alerts designed to catch a forced intrusion.

flowchart LR A[Unauthorized access] --> B[Internal systems + mobile app] B --> C[Identity theft: names, dates, ID documents] C --> D[1.2 million people affected]

This is also why the Canadian Centre for Cyber Security lists multi-factor authentication at the top of its baseline controls: it neutralizes the most common scenario, a password stolen elsewhere and reused on your systems.

How can you lock down access without launching a major project?

Three measures close off most of this scenario. Roll out multi-factor authentication everywhere, including on administrator accounts. Segment the network so an intruder can’t move freely once inside. Review active accounts and revoke the ones with no current owner.

  • Multi-factor authentication, everywhere and without exception. A stolen password is no longer enough to get in. It’s the control with the best cost-to-risk-reduction ratio, and it’s often already included in your existing licenses.
  • Network segmentation. An intruder who gets in somewhere shouldn’t be able to reach everywhere. The question to ask is simple: from an accounting workstation, what can actually be reached?
  • Access reviews. How many “ghost” accounts (former employees, contractors who left, service accounts from a closed project) are still active in your environment? No one monitors their use, and exploiting them takes no particular skill.

At RISS, we lock down access, deploy multi-factor authentication, and segment networks so that a stolen key doesn’t open the whole house.

FAQ

We don’t hold any identification documents. Does this apply to us?

Yes, because the mechanism doesn’t depend on the type of data involved. What was exploited here was access, and every organization grants access to something. A client list, an employee file, or a billing history all carry enough market value to justify a break-in. The useful question isn’t “is our data worth stealing?” but “who can access what, and would we even know?”

Does multi-factor authentication slow teams down?

For the first few weeks, yes, somewhat. After that, it becomes routine, especially if you allow trusted devices to be remembered for a reasonable period. The common mistake is enabling it first for staff accounts and forgetting administrator accounts and remote access, which are exactly the ones an attacker targets.

How do we know if our credentials are already circulating?

Breach monitoring services let you check whether addresses on your domain appear in leaked datasets. It’s a useful starting point, but a partial one: a breach that hasn’t been published won’t show up there. The measure that actually protects you remains multi-factor authentication, because it makes a stolen credential insufficient on its own, whether or not it has leaked.

Sources