British Airways reveals massive data breach, could face £500m fine under GDPR

The financial and personal details of 380,000 customers were stolen in the hack

A line of British Airways aeroplanes

British Airways (BA) has revealed it's been the subject of a massive data breach thought to have affected hundreds of thousands of customers over a two week-period last month.

It has now recruited the help of the National Crime Agency and National Cyber Security Centre to investigate into how the incident was able to happen.

BA has confirmed that only bookings made between 22:58 BST 21 August and 21:45 5 September are thought to have been affected, however, those customers involved are likely to have had their personal and financial details compromised as a result.

BA said details including personal information and payment data may have been stolen from those using the company's website and mobile app to make bookings. However, passport details and travel plans were not accessed by the hackers, the airline said, and stressed that only people who hade bookings during the two-week period in question were at risk.

BA revealed that 380,000 customer transactions were compromised and those involved had been advised by the company on Thursday night that their information may be at risk.

"The breach has been resolved and our website is working normally," BA said in a statement. "We have notified the police and relevant authorities. We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers' data very seriously."

BA said it began notifying affected customers at 22:00 on Thursday evening but that this process had been delayed due to the high volume of emails being sent.

Anyone who thinks they may have been a subject of fraud as a result of the attack should contact their bank or credit card provider as a matter of urgency to prevent any further malicious activity occurring, BA said in the statement. Those contacted by BA should change their online passwords immediately and monitor the account or statements of the card used to make their travel purchase.

"We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers' data very seriously," Alex Cruz, British Airways' chairman and chief executive said.

The incident marks one of the first major data breaches to occur since the enactment of the GDPR, raising the possibility that BA could be one of the first companies to be hit by the new, higher penalties. If the company is hit with the maximum fine, 4% of global turnover, it's likely to be as high as 500 million, based on BA's 2017 revenue reports.

"We are aware of an incident involving British Airways and are making enquiries," a spokesperson for the Information Commissioner's Office said.

Chris Boyd, lead malware analyst at Malwarebytes, told IT Pro that it's fortunate BA has been able to give a specific time and date range for the data breach.

"Typically, we're lucky to get a date range of less than six months to a year, which makes a potential victim's response to any threat difficult," said Boyd. "This could end up being a major test of new GDPR regulations, and it'll be fascinating to see the cause of the breach come out in the wash."

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
Your essential guide to internet security
Security

Your essential guide to internet security

25 Jun 2021

Most Popular

Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
Synology DiskStation DS2422+ review: A cube of great capacity
network attached storage (NAS)

Synology DiskStation DS2422+ review: A cube of great capacity

10 Jan 2022