Security Market Segment LS
Friday, 07 September 2018 06:27

Personal, financial data of customers stolen from British Airways site Featured

Personal, financial data of customers stolen from British Airways site Pixabay

The personal and financial details of 380,000 customers who made bookings with British Airways on its website between 21 August and 5 September have been stolen, the airline says.

The airline, which ranks eighth worldwide in terms of passenger-kilometres flown by individual carriers, said the stolen data did not include passport or travel details.

The airline said the breach had been "resolved" and "our website is working normally". No specifics were provided about the nature of the breach.

BA said was making contact with affected customers and "we advise any customers who believe they may have been affected by this incident to contact their banks or credit card providers and follow their recommended advice".

Police and other relevant authorities had been notified, BA said.

Alex Cruz, British Airways’ chairman and chief executive, said: “We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers’ data very seriously.”

In May last year, BA was hit by a power surge in its control centre near Heathrow and its IT systems went down, causing stoppage of global flights, according to  The Guardian.

The airline could face fines over the breach under the new General Data Protection Regulations. Fines are now a maximum of 4% of global revenue, which in BA's case could be as much as £500 million.

The Guardian quoted Rob Burgess, the editor of the British frequent flyer website Head for Points, as saying: “Data breaches are part and parcel of the world we now live in, and criminal activity is getting ever more sophisticated.

"Unfortunately, this is likely to be another PR disaster for British Airways, especially as it includes tickets bought in their September sale which is being widely promoted at the moment.”

"But this is not the whole story. Air Canada was hacked and between 22 August and 24 August customers' passport details may have been compromised. The overlapping dates are probably a blessing as the odds are small that the same customers booked both airlines in the two day window of overlap," Randy Abrams, senior security analyst at security firm Webroot, commented.

"In the case of the Air Canada breach, customer data potentially including passport numbers and expiry date, passport country of issuance, NEXUS numbers for trusted travellers, gender, dates of birth, nationality and country of residence may have been compromised.

"In both cases, this is data that now may be available to cyber criminals to aggregate and correlate to build significantly comprehensive profiles."

Brian Contos, chief information and security officer at security instrumentation firm Verodin, said: “Very simply, personal data holds value, so nefarious individuals target it.

"Why? Because, they know most organisations operate with security tools that are around 25% to 50% effective at best, thus their chances for success are high.

"You can have the best people, the best technology, and follow the best processes, but if you lack a mechanism to constantly measure and improve the efficacy of your security tools, you’re simply operating under false assumptions.

"It’s like driving a car without a fuel gauge and assuming that because the tank was full 250 miles ago, it’s still full now.

"Until organisations start focusing on validating and optimising their security tools, instead of just throwing money and resources into the next shiny, security box, or security service, with hopes that it will finally solve their issues, our data will be stolen and criminals will prosper."

Tony Jarvis, chief strategist – Asia Pacific, Middle East & Africa, of security firm Check Point Software, said: "Unfortunately for the general public, given the prevalence of such breaches in recent times, it is important to be aware of what actions to take should such situations occur.

"Following up with British Airways, observing any guidance they offer to affected customers, and changing account passwords are all necessary steps.

"This serves as a reminder for other companies in possession of customer data just how serious breaches can be and the priority with which security measures should be put in place to safeguard that data."

Read 2998 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here


If you're looking at enabling Microsoft Teams for your contact centre, you should bookmark this webinar.

Marketing budgets are now focused on Webinars combined with Lead Generation.

Our panellists from Whangarei District Council (NZ) and Maurice Blackburn Lawyers (Aus) were closely involved in recent projects to enable Microsoft Teams for their own contact centres.

They have kindly agreed to join Enghouse and Microsoft to talk about some of the things they would recommend as most critical for IT and CX professionals planning a Teams Contact Centre migration.

Date: 11 May 2022
Time: 12pm AEST | 2pm NZST | 10am SGT

We look forward to having you join us. Please click the button below to register.



The past year has seen a meteoric rise in ransomware incidents worldwide.

Over the past 12 months, SonicWall Capture Labs threat researchers have diligently tracked the meteoric rise in cyberattacks, as well as trends and activity across all threat vectors, including:

Encrypted threats
IoT malware
Zero-day attacks and more

These exclusive findings are now available via the 2022 SonicWall Cyber Threat Report, which ensures SMBs, government agencies, enterprises and other organizations have the actionable threat intelligence needed to combat the rising tide of cybercrime.

Click the button below to get the report.



It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site and prominent Newsletter promotion and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.


Sam Varghese

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News