WestJet said it is investigating after a “technical issue” with the airline’s app on Wednesday afternoon allowed some users to see other customers’ personal information.
Some people told CBC News they could see other users’ profile information that included phone numbers, home addresses, dates of birth, email addresses, WestJet dollars and flight voucher details, and in some cases , the last four digits of a user’s credit card number. .
In an emailed statement to CBC News, a WestJet spokesperson said at 3:53 pm MT, “a technical issue was identified that affected guest profiles on the WestJet app.” He added that the matter was resolved at 4:27 pm MT.
However, Paul Baines, a user of the WestJet app who was able to see multiple profiles on the app, said he believes the issue took an hour longer than WestJet indicated.
Baines, who is from London, England, is visiting his partner Victoria Angus in Toronto. Angus said she first noticed the problem at around 3pm when she logged into her app to check flights to London.
“When I went into my profile, the profile had some random person’s name on it,” Angus said. She could see the person’s contact information along with some of their credit card information.
When she went to look at her member information, Angus said she saw a second person’s personal information.
“Four or five times this was happening randomly setting different profile information every time I refreshed the screen.”
Baines said when he looked at the app, in some cases he could see the last four numbers of other users’ credit cards and the name of the credit card company, among other private data.
WestJet apologizes
“There was enough information that if you had a nefarious actor, you could have compromised people’s data,” he said.
“This is a very serious data breach regarding the availability of this data.”
In its statement, WestJet apologized to guests for the disruption and said it is investigating the matter.
“We take our guests’ privacy extremely seriously and will continue to provide updates to our guests as needed,” WestJet said.
WestJet did not respond to CBC’s questions about how many people were affected by the technology glitch and how much personal user information was shared.
Other WestJet app users reported similar experiences on Twitter Wednesday afternoon.
Derek Bowen of Nanaimo, BC, said when he looked at his app, he saw the private information of two other people. In one part of the app, he could see a user’s personal contact information. In another part of the app he could see a second person’s travel bank, rewards bank and travel vouchers.
“It just shocked me that I could get that information,” he said.
Users are not satisfied with the response
Baines, Angus and Bowen said they immediately contacted WestJet to report the issue when they discovered it, but were disappointed with the results.
Angus reached out on social media and received an automated response. She then called the customer service line, where she got some information.
“They say, ‘yes, we are aware of the problem. We are not IT so we don’t know what to do. You know, they’re fixing it.” And that was pretty much it,” she said.
Angus said she reached out to the airline, asking that someone contact her to let her know if anyone had seen her personal information.
“Because if I’m accessing someone else, someone is probably accessing mine. I want to know how many hits there have been on my data.”
Baines tried to contact a technology officer who works for WestJet through LinkedIn. He said he explained the issue to the employee and was told the airline was looking into it.
Meanwhile, Bowen said he sent the airline a direct message on Twitter, but he didn’t hear back.
“What has actually impressed me is that there has been no announcement from WestJet on Twitter or on their websites,” he said.
Baines added: “We’re now in a position of that data coming out of a secure environment. So do I trust using this company again? I would say my trust in the company has gone down.”
