British Airways data breach is bigger than first thought, admits BA

British Airways has revealed that another 185,000 customers have been hit by the data breach the company revealed last month.

Previously it was believed that 380,000 customers who made bookings between 21 August and 5 September were hit by a breach caused by just 22 lines of malicious Javascript. Following that report, BA downgraded the number to 244,000 but now, BA owners International Airlines Group (IAG) believe that customers who made reward bookings using payment cards between 21 April and 28 July may also be at risk.

BA also believes that hackers may have stolen the names, addresses, email addresses, card numbers, expiry dates and card verification value (CVV) numbers for another 77,000 customers. This means that fraudulent purchases could now be possible. Another 108,000 could have had details stolen, not including CVV, meaning hackers could still be sat on valuable information.

READ NEXT: How to protect yourself from a data breach

All affected customers of this extended data breach discovery will be emailed before 5pm today, Friday 26 October.

Currently, BA says it hasn’t yet received any verified reports of fraud in relation to the data breach, and, according to IAG, it has been “working continuously with specialist cyber forensic investigators and the National Crime Agency to investigate fully the data theft.”

There’s also no “conclusive evidence” that data has been removed from its systems but advises all those affected to contact their bank or card provider “as a precaution”. IAG also hasn’t disclosed just how the breach happened, nor how this new wider breach was discovered, as it doesn’t want to compromise an ongoing investigation.

The news of this breach comes hot on the heels of a catastrophic Cathay Pacific data breach that saw 9.4 million customers’ data exposed.

Original story continues below:

British Airways (BA) has revealed it’s been the subject of a massive data breach thought to have affected over 380,000 customers over a two week period last month.

BA has confirmed that bookings made between 22:58 BST 21 August and 21:45 5 September are the only ones thought to have been affected. However, those customers involved are likely to have had their personal and financial details compromised as a result. To help facilitate BA’s investigations, it has now recruited the help of the National Crime Agency and National Cyber Security Centre to investigate how the incident was able to happen.

BA said details including personal information and payment data may have been stolen from those using the company’s website and mobile app to make bookings. However, passport details and travel plans were not accessed by the hackers, the airline said, and stressed that only people who hade bookings during the two-week period in question were at risk. Customers were informed on Thursday night that their information may be at risk.

READ NEXT: Are you affected by the NHS’s yearly 10,000-patient data breach?

It began notifying affected customers at 22:00 on Thursday evening but that this process had been delayed due to the high volume of emails being sent.

“The breach has been resolved and our website is working normally,” BA said in a statement. “We have notified the police and relevant authorities. We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers’ data very seriously.”

Anyone who thinks they may have been a subject of fraud as a result of the attack should contact their bank or credit card provider as a matter of urgency to prevent any further malicious activity occurring, BA said in the statement. Those contacted by BA should change their online passwords immediately and monitor the account or statements of the card used to make their travel purchase.

READ NEXT: How Apple was hacked by a 16-year-old schoolboy

“We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers’ data very seriously,” Alex Cruz, British Airways’ chairman and chief executive said.

The incident marks one of the first major data breaches to occur since the enactment of GDPR, raising the possibility that BA could be one of the first companies to be hit by the new, higher penalties.

“We are aware of an incident involving British Airways and are making enquiries,” a spokesperson for the Information Commissioner’s Office said.

Chris Boyd, lead malware analyst at Malwarebytes, told Alphr that it’s fortunate BA has been able to give a specific time and date range for the data breach.

“Typically, we’re lucky to get a date range of less than six months to a year, which makes a potential victim’s response to any threat difficult,” said Boyd. “This could end up being a major test of new GDPR regulations, and it’ll be fascinating to see the cause of the breach come out in the wash.”