Data breach reference · August 2018

The Air Canada data breach

What was disclosed and how to check whether your address was in it.

At a glance
Disclosed
28 August 2018
Records
20,000 (Office of the Privacy Commissioner of Canada)
Type
Mobile app breach
Sector
General

Check whether your address was in it

No account needed. The address is used only to run the check. Privacy

This disclosure

What is on the record.

20,000
Records reported in the disclosure
2,988 days
Since the disclosure, 28 Aug 2018

Source: Office of the Privacy Commissioner of Canada, as recorded in the LeakTrace tracker.

What happened

In August 2018, Air Canada detected unusual login behavior on its mobile app and locked down all 1.7 million user accounts as a precaution. Approximately 20,000 profiles were later confirmed to have been accessed.

Exposed information may have included names, email addresses, phone numbers, passport numbers, expiration dates, country of residence, gender, birth date, and other travel preferences. Air Canada forced all users to reset their passwords when the app came back online.

Reported impact: App re-issued, class-action settled

Source: Office of the Privacy Commissioner of Canada, 28 Aug 2018.

What to do if you were affected

  1. Change your Air Canada Aeroplan password if you have not since 2018.
  2. If your passport number was potentially exposed, monitor for identity theft.
  3. Enable two-factor authentication on your Aeroplan account.
  4. Watch for phishing emails referencing flight bookings or Aeroplan miles.
  5. Review your other airline / travel loyalty accounts for reused passwords.

Common questions

When was the Air Canada breach disclosed?
In August 2018. Public reporting was carried by Office of the Privacy Commissioner of Canada.
How many people were affected?
20,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with Air Canada at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it and not reusing it, closes that door.

Other breaches in this sector

ConduentOct 2026 · 62,000,000 recordsDodo PizzaSep 2026 · 68,000,000 recordsTicketmasterMay 2024 · 560,000,000 recordsLondon DrugsApr 2024 · 3,000,000 records

Is your address in a public breach? Check my address →