Security Market Segment LS
Friday, 07 September 2018 06:27

Personal, financial data of customers stolen from British Airways site Featured

Personal, financial data of customers stolen from British Airways site Pixabay

The personal and financial details of 380,000 customers who made bookings with British Airways on its website between 21 August and 5 September have been stolen, the airline says.

The airline, which ranks eighth worldwide in terms of passenger-kilometres flown by individual carriers, said the stolen data did not include passport or travel details.

The airline said the breach had been "resolved" and "our website is working normally". No specifics were provided about the nature of the breach.

BA said was making contact with affected customers and "we advise any customers who believe they may have been affected by this incident to contact their banks or credit card providers and follow their recommended advice".

Police and other relevant authorities had been notified, BA said.

Alex Cruz, British Airways’ chairman and chief executive, said: “We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers’ data very seriously.”

In May last year, BA was hit by a power surge in its control centre near Heathrow and its IT systems went down, causing stoppage of global flights, according to  The Guardian.

The airline could face fines over the breach under the new General Data Protection Regulations. Fines are now a maximum of 4% of global revenue, which in BA's case could be as much as £500 million.

The Guardian quoted Rob Burgess, the editor of the British frequent flyer website Head for Points, as saying: “Data breaches are part and parcel of the world we now live in, and criminal activity is getting ever more sophisticated.

"Unfortunately, this is likely to be another PR disaster for British Airways, especially as it includes tickets bought in their September sale which is being widely promoted at the moment.”

"But this is not the whole story. Air Canada was hacked and between 22 August and 24 August customers' passport details may have been compromised. The overlapping dates are probably a blessing as the odds are small that the same customers booked both airlines in the two day window of overlap," Randy Abrams, senior security analyst at security firm Webroot, commented.

"In the case of the Air Canada breach, customer data potentially including passport numbers and expiry date, passport country of issuance, NEXUS numbers for trusted travellers, gender, dates of birth, nationality and country of residence may have been compromised.

"In both cases, this is data that now may be available to cyber criminals to aggregate and correlate to build significantly comprehensive profiles."

Brian Contos, chief information and security officer at security instrumentation firm Verodin, said: “Very simply, personal data holds value, so nefarious individuals target it.

"Why? Because, they know most organisations operate with security tools that are around 25% to 50% effective at best, thus their chances for success are high.

"You can have the best people, the best technology, and follow the best processes, but if you lack a mechanism to constantly measure and improve the efficacy of your security tools, you’re simply operating under false assumptions.

"It’s like driving a car without a fuel gauge and assuming that because the tank was full 250 miles ago, it’s still full now.

"Until organisations start focusing on validating and optimising their security tools, instead of just throwing money and resources into the next shiny, security box, or security service, with hopes that it will finally solve their issues, our data will be stolen and criminals will prosper."

Tony Jarvis, chief strategist – Asia Pacific, Middle East & Africa, of security firm Check Point Software, said: "Unfortunately for the general public, given the prevalence of such breaches in recent times, it is important to be aware of what actions to take should such situations occur.

"Following up with British Airways, observing any guidance they offer to affected customers, and changing account passwords are all necessary steps.

"This serves as a reminder for other companies in possession of customer data just how serious breaches can be and the priority with which security measures should be put in place to safeguard that data."


26-27 February 2020 | Hilton Brisbane

Connecting the region’s leading data analytics professionals to drive and inspire your future strategy

Leading the data analytics division has never been easy, but now the challenge is on to remain ahead of the competition and reap the massive rewards as a strategic executive.

Do you want to leverage data governance as an enabler?Are you working at driving AI/ML implementation?

Want to stay abreast of data privacy and AI ethics requirements? Are you working hard to push predictive analytics to the limits?

With so much to keep on top of in such a rapidly changing technology space, collaboration is key to success. You don't need to struggle alone, network and share your struggles as well as your tips for success at CDAO Brisbane.

Discover how your peers have tackled the very same issues you face daily. Network with over 140 of your peers and hear from the leading professionals in your industry. Leverage this community of data and analytics enthusiasts to advance your strategy to the next level.

Download the Agenda to find out more


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments