The airline, which ranks eighth worldwide in terms of passenger-kilometres flown by individual carriers, said the stolen data did not include passport or travel details.

The airline said the breach had been "resolved" and "our website is working normally". No specifics were provided about the nature of the breach.

BA said was making contact with affected customers and "we advise any customers who believe they may have been affected by this incident to contact their banks or credit card providers and follow their recommended advice".

Alex Cruz, British Airways’ chairman and chief executive, said: “We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers’ data very seriously.”

In May last year, BA was hit by a power surge in its control centre near Heathrow and its IT systems went down, causing stoppage of global flights, according to  The Guardian.

The airline could face fines over the breach under the new General Data Protection Regulations. Fines are now a maximum of 4% of global revenue, which in BA's case could be as much as £500 million.

The Guardian quoted Rob Burgess, the editor of the British frequent flyer website Head for Points, as saying: “Data breaches are part and parcel of the world we now live in, and criminal activity is getting ever more sophisticated.

"Unfortunately, this is likely to be another PR disaster for British Airways, especially as it includes tickets bought in their September sale which is being widely promoted at the moment.”

"But this is not the whole story. Air Canada was hacked and between 22 August and 24 August customers' passport details may have been compromised. The overlapping dates are probably a blessing as the odds are small that the same customers booked both airlines in the two day window of overlap," Randy Abrams, senior security analyst at security firm Webroot, commented.

"In the case of the Air Canada breach, customer data potentially including passport numbers and expiry date, passport country of issuance, NEXUS numbers for trusted travellers, gender, dates of birth, nationality and country of residence may have been compromised.

"In both cases, this is data that now may be available to cyber criminals to aggregate and correlate to build significantly comprehensive profiles."

Brian Contos, chief information and security officer at security instrumentation firm Verodin, said: “Very simply, personal data holds value, so nefarious individuals target it.

"Why? Because, they know most organisations operate with security tools that are around 25% to 50% effective at best, thus their chances for success are high.

"You can have the best people, the best technology, and follow the best processes, but if you lack a mechanism to constantly measure and improve the efficacy of your security tools, you’re simply operating under false assumptions.

"It’s like driving a car without a fuel gauge and assuming that because the tank was full 250 miles ago, it’s still full now.

"Until organisations start focusing on validating and optimising their security tools, instead of just throwing money and resources into the next shiny, security box, or security service, with hopes that it will finally solve their issues, our data will be stolen and criminals will prosper."

Tony Jarvis, chief strategist – Asia Pacific, Middle East & Africa, of security firm Check Point Software, said: "Unfortunately for the general public, given the prevalence of such breaches in recent times, it is important to be aware of what actions to take should such situations occur.

"Following up with British Airways, observing any guidance they offer to affected customers, and changing account passwords are all necessary steps.

"This serves as a reminder for other companies in possession of customer data just how serious breaches can be and the priority with which security measures should be put in place to safeguard that data."