An Ontario couple says Air Canada theft disrupted their vacation and left them stranded. They also accuse the airline of blaming them instead of helping resolve the issue.
Bill and Sandra Barlow from Milton, Ontario, had spent over a year planning a trip to South and Central America. They booked business class flights using Aeroplan points and $5,000 in cash to celebrate Bill’s 75th birthday.
Two days before their flight home, they checked their reservation and discovered the return tickets had vanished. When they contacted Air Canada, they learned someone had cancelled the flights and used their travel credit to book a business class seat to Tokyo — for someone they’d never heard of.
The airline insisted the couple’s personal email was hacked. They claimed the hacker used the “forgot password” tool to access the Barlows’ Aeroplan account and drain their Air Canada Wallet. Bill and Sandra said they had never activated or used that feature and didn’t even know it existed.
Cybersecurity expert Claudiu Popa questioned the explanation. He said Air Canada couldn’t confirm an email breach without access to the Barlows’ email account. He also raised concerns about weaknesses in Air Canada’s digital infrastructure, not just the customers’ email security.
The couple asked the airline for details about the investigation but received no clear answers. When CBC’s Go Public team contacted Air Canada, the company doubled down. They said customers are responsible for protecting their personal email accounts and refused to share further information.
Popa warned that the system might expose other travelers to similar risks. He mentioned Air Canada’s history of data issues, including a 2018 breach that exposed 20,000 customer accounts and a 2023 incident involving employee data.
With no time left to argue, the couple paid nearly $2,800 for economy tickets home — a major downgrade from the business class seats they’d lost. They estimate rebooking the same class would have cost close to $9,000.
The couple also asked whether Air Canada investigated the person who flew to Tokyo using their credit. They didn’t get a response. Go Public located the woman in Las Vegas. She confirmed the trip, claimed she booked it through a travel agent, and said she used her own credit card. However, she refused to provide proof or the agent’s name. She also said the airline never contacted her.
Bill and Sandra said they felt frustrated and ignored. After two months, Air Canada finally responded to their complaint — only to blame them again and offer no compensation.
Their case raises major concerns about customer protection, system security, and corporate accountability. The Air Canada theft left them without support, and their story serves as a warning to other travelers who rely on digital tools to manage flights.
