Well now we know why AC is offering $21.5M and £21.5M LMUs.

Isn't this similar to what can be done with an AE number? I mean, without the password it's not that useful right? It's still not something I'd be sharing (I could be missing something here).

I would be surprised if places are accepting things like a passport number without the actual item though to get a bank account, credit card, mortgage etc... Certainly when I've gone into banks I needed the actual document, quoting details of my whatever document (and I've used multiple) wasn't going to be enough, they wanted the document with the photo page. One bank wouldn't even accept my SIN number on paper (back when they did cards). I think a few banks actually scanned the docs too.

Now, I'm agreeing with cow, definitely not saying it's good, just don't think it justifies getting a new passport at this time but will keep my standard eye on my credit rating and so on. And one of the bigger risks here is with information beyond the passport number/date of expiry, things like my full name, place and date of birth, that's information I can't change that I wouldn't want public. It's a bit like your name and address. I know people who shred anything with their name and address on (I often do it too), yet this information is ridiculously easy to get a hold of.

So, I DO think AC should be doing something about it except shrugging BA style. I don't see them doing it unless a significant agency (like the government) gets involved - as per veronc's post.
Without these sort of actions, there's no ROI, just some bad PR, and they can easily countact that by running more ads about how they keep winning SkyTrak surveys or whatever.

:D

I got a phone call today from the Office of the Privacy Commissioner of Canada following up on their investigation into my complaint. I was actually quite surprised at the research they have done so far. They said that Air Canada notified them at the same time they notified the users of the App. When I mentioned that the App still didn't have two factor authentication he was quite surprised and he was also surprised they had such a lax password setting prior to the breach. They hadn't started their investigation into the app itself yet. It's been going thru the documentation they received from AC as well as people who filed complaints. This is the second time they have reached out to give a status update... I'm quite surprised as my expectations of the government are not high LOL. I again explained my main frustration was the incorrect information I was given by Air Canada as well as their denial to pay for credit/identity protection services (I'm paying it on my own right now).