British Airways is facing a multimillion-pound fine as it grapples with the fallout of a massive data breach which the airline’s chief executive has described as a “malicious criminal attack”.
Thousands of BA customers have had to cancel their credit cards after the 15-day data hack compromised 380,000 payments.
A criminal inquiry is being led by specialist cyber officers from the National Crime Agency (NCA).
Cyber criminals behind the attack obtained enough credit card details to use them, and BA now faces a possible fine of around £500 million over the breach, with the Information Commissioner’s Office (ICO) also investigating the incident.
We are investigating the theft of customer data from our website and our mobile app, as a matter of urgency. For more information, please click the following link:https://t.co/2dMgjw1p4r
— British Airways (@British_Airways) September 6, 2018
BA’s data breach took place after the introduction of the new Data Protection Act, which includes the provisions of the new European General Data Protection Regulation (GDPR).
Under the new regulations, the maximum penalty for a company hit with a data breach is a fine of either £17 million or 4% of global turnover, whichever is greater.
In the year ended December 31 2017, BA’s total revenue was £12.2 billion, meaning the company could face a fine of around £500 million if the ICO takes action.
The NCA said investigations of this type are “often complex and take some time before the full details can be established”.
It warned that “opportunist criminals” often use these incidents to conduct “secondary fraud attacks”.
Speaking on the BBC, Alex Cruz, BA’s chairman and chief executive, said: “There was a very sophisticated, malicious criminal attack on our website.
“We became aware initially on that day, and we began to work on it. We discovered that something had happened, and immediately we began to work.”
Shares in IAG, BA’s parent firm, were down more than 3% in morning trade as investors digested the news.
Mr Cruz went on to apologise for the failure, adding that BA is “100% committed” to compensating customers who are financially affected.
“We’re extremely sorry. I know that it is causing concern to some of our customers, particularly those customers that made transactions over BA.com and app.”
He added: “We know that the information that has been stolen is name, address, email address, credit card information; that would be credit card number, expiration date and the three-letter code in the back of the credit card.
“No itinerary information, no frequent flier data, no passport data has been compromised.”
BA said it was investigating the breach, which took place from 11pm on August 21 until 9.45pm on Wednesday, and is co-operating with relevant regulators.
The incident comes after an IT meltdown caused huge disruption for BA passengers at the start of the May half-term holiday.
Unfortunately it’s not soon enough. No point at this stage; card is cancelled causing my wife and I fairly significant disruption, I will be doing my utmost to chose other airlines over BA from now on, I usually do anyway but others didn’t have the times I wanted on this occasion
— Mat Thomas (@phiebs) September 6, 2018
Some 75,000 passengers were left stranded after a glitch forced the airline to cancel nearly 726 flights over three days.
Following the latest breach, worried customers rushed to social media and helplines after the airline urged anyone who suspected they may have been affected to contact their bank or credit card provider.
There were reports of banks being inundated with calls, leaving account holders in lengthy queues, while some BA customers said they had to have cards cancelled and reissued as a result.
Customer Mat Thomas said he had placed a booking on August 27, but had not been contacted over the breach.
Finally got through to my bank. Feel sorry for them as it’s not their fault and they are experiencing extremely high call volumes due to this breach! Couldn’t do anything other than cancel my card… not how I wanted to spend my Thursday evening
— Gemma Robyn Theobald (@GemmaRobyn) September 6, 2018
“Atrocious that I had to find out about this via news and twitter,” he tweeted.
“Called bank and had to cancel both mine and my wife’s card. Probably won’t get it back before we fly (ironically).
“Terrible handling of the situation as I’ve still not received an email from BA!”
Banks including NatWest and RBS attempted to reassure worried BA customers that they have “significant” levels of security in place, although they advised account holders to be on the lookout for any suspicious activity.
Which? said it was “vital” BA moved quickly to ensure affected customers get clear information and what steps they need to take to protect themselves.
